-1

I noticed some wierd behavior in our firewall logs: a computer in our subnet 192.168.1.0/24 sending UDP packets in port 161 to an IP in subnet 192.168.20.0 (we don't have a subnet like that), and the packets going through the LAN to WAN policy. I have installed Sysmon in the computer that is creating this connection, but I don't know what to look for in it. Does anybody in here have an idea of what is going on? I'm sorry if I'm not giving enough info. I don't want to mess up giving too much details.

closed as too broad by multithr3at3d, Xander, ThoriumBR, MechMK1, Rory Alsop Jul 22 at 10:28

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Welcome to the site! You will probably need to provide much more information about the system and ensure the question specifically relates to information security, otherwise it may be off topic. – multithr3at3d Jul 20 at 20:06
3

Not giving much details means that you get a global answer.

161 is SNMP. Not traps, SNMP. Anything doing an unexpected SNMP should be subject of investigation. The process may be called something with snmp in the name. If you (or the owner) do not know why this system uses SNMP, you should disconnect it from the network and run a full up-to-date virusscan on it.

I don't know your network set-up, but if your network is 192.168.1.0/24, anything outside that subnet will go to the gateway, which is probably your firewall. Therefore your firewall will see it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.