How much network noise is normal? [closed]

Question

on my Ubuntu VPS I am getting a lot of requests and portscans from foreign sources. They are all blocked by UFW. However my question is, if this much "network noise" is normal or is my server being targeted?

Here is the UFW log:

Mar 17 14:23:26 [UFW BLOCK] IN=eth0 SRC=89.248.163.157 DST=my_server_ip PROTO=TCP SPT=41838 DPT=1949
Mar 17 14:23:56 [UFW BLOCK] IN=eth0 SRC=154.89.5.86 DST=my_server_ip PROTO=TCP SPT=40833 DPT=1241
Mar 17 14:24:06 [UFW BLOCK] IN=eth0 SRC=23.95.132.46 DST=my_server_ip PROTO=TCP SPT=43149 DPT=8443
Mar 17 14:24:21 [UFW BLOCK] IN=eth0 SRC=78.128.113.250 DST=my_server_ip PROTO=TCP SPT=53071 DPT=1053
Mar 17 14:24:45 [UFW BLOCK] IN=eth0 SRC=154.89.5.86 DST=my_server_ip PROTO=TCP SPT=40833 DPT=6003
Mar 17 14:25:03 [UFW BLOCK] IN=eth0 SRC=167.94.138.142 DST=my_server_ip PROTO=TCP SPT=31939 DPT=3270
Mar 17 14:25:34 [UFW BLOCK] IN=eth0 SRC=154.89.5.86 DST=my_server_ip PROTO=TCP SPT=40833 DPT=3050
Mar 17 14:25:42 [UFW BLOCK] IN=eth0 SRC=89.248.165.178 DST=my_server_ip PROTO=TCP SPT=36805 DPT=7168
Mar 17 14:26:08 [UFW BLOCK] IN=eth0 SRC=154.89.5.88 DST=my_server_ip PROTO=TCP SPT=55356 DPT=994
Mar 17 14:26:22 [UFW BLOCK] IN=eth0 SRC=154.89.5.86 DST=my_server_ip PROTO=UDP SPT=40833 DPT=3671
Mar 17 14:26:39 [UFW BLOCK] IN=eth0 SRC=167.248.133.134 DST=my_server_ip PROTO=TCP SPT=15551 DPT=49152
Mar 17 14:26:59 [UFW BLOCK] IN=eth0 SRC=167.99.237.93 DST=my_server_ip PROTO=TCP SPT=43510 DPT=26462
Mar 17 14:27:30 [UFW BLOCK] IN=eth0 SRC=154.89.5.86 DST=my_server_ip PROTO=UDP SPT=40833 DPT=6060
Mar 17 14:27:39 [UFW BLOCK] IN=eth0 SRC=154.89.5.86 DST=my_server_ip PROTO=TCP SPT=40833 DPT=5801
Mar 17 14:28:06 [UFW BLOCK] IN=eth0 SRC=143.110.149.30 DST=my_server_ip PROTO=TCP SPT=43338 DPT=32311
Mar 17 14:28:24 [UFW BLOCK] IN=eth0 SRC=167.94.146.67 DST=my_server_ip PROTO=TCP SPT=41804 DPT=631
Mar 17 14:28:41 [UFW BLOCK] IN=eth0 SRC=154.89.5.86 DST=my_server_ip PROTO=TCP SPT=40833 DPT=4712
Mar 17 14:29:15 [UFW BLOCK] IN=eth0 SRC=92.255.85.237 DST=my_server_ip DF PROTO=TCP SPT=34576
Mar 17 14:29:22 [UFW BLOCK] IN=eth0 SRC=92.255.85.237 DST=my_server_ip DF PROTO=TCP SPT=34576
Mar 17 14:29:45 [UFW BLOCK] IN=eth0 SRC=167.248.133.137 DST=my_server_ip PROTO=TCP SPT=46139 DPT=2222
Mar 17 14:30:16 [UFW BLOCK] IN=eth0 SRC=167.248.133.152 DST=my_server_ip PROTO=TCP SPT=59636 DPT=7777
Mar 17 14:30:28 [UFW BLOCK] IN=eth0 SRC=185.167.96.150 DST=my_server_ip PROTO=TCP SPT=46919 DPT=111
Mar 17 14:30:40 [UFW BLOCK] IN=eth0 SRC=59.127.155.198 DST=my_server_ip PROTO=TCP SPT=48938 DPT=8080
Mar 17 14:31:33 [UFW BLOCK] IN=eth0 SRC=164.92.79.132 DST=my_server_ip PROTO=TCP SPT=57918 DPT=48122
Mar 17 14:31:34 [UFW BLOCK] IN=eth0 SRC=167.248.133.143 DST=my_server_ip PROTO=TCP SPT=28359 DPT=2079
Mar 17 14:31:55 [UFW BLOCK] IN=eth0 SRC=60.220.202.72 DST=my_server_ip DF PROTO=TCP SPT=12013
Mar 17 14:32:23 [UFW BLOCK] IN=eth0 SRC=162.142.125.95 DST=my_server_ip PROTO=TCP SPT=8417 DPT=12490
Mar 17 14:33:20 [UFW BLOCK] IN=eth0 SRC=92.63.196.25 DST=my_server_ip PROTO=TCP SPT=48659 DPT=19317
Mar 17 14:33:33 [UFW BLOCK] IN=eth0 SRC=162.142.125.82 DST=my_server_ip PROTO=TCP SPT=32799 DPT=20090
Mar 17 14:33:53 [UFW BLOCK] IN=eth0 SRC=192.241.225.62 DST=my_server_ip PROTO=TCP SPT=57545 DPT=8080
Mar 17 14:34:08 [UFW BLOCK] IN=eth0 SRC=194.26.29.169 DST=my_server_ip PROTO=TCP SPT=48091 DPT=3319
Mar 17 14:34:20 [UFW BLOCK] IN=eth0 SRC=111.20.54.147 DST=my_server_ip DF PROTO=TCP SPT=7076
Mar 17 14:34:25 [UFW BLOCK] IN=eth0 SRC=91.240.118.31 DST=my_server_ip PROTO=TCP SPT=50612 DPT=2832
Mar 17 14:34:51 [UFW BLOCK] IN=eth0 SRC=45.79.74.99 DST=my_server_ip PROTO=TCP SPT=20092 DPT=5601
Mar 17 14:34:53 [UFW BLOCK] IN=eth0 SRC=193.124.7.9 DST=my_server_ip PROTO=TCP SPT=40269 DPT=5678
Mar 17 14:35:04 [UFW BLOCK] IN=eth0 SRC=128.14.209.165 DST=my_server_ip PROTO=TCP SPT=25552 DPT=8443
Mar 17 14:35:24 [UFW BLOCK] IN=eth0 SRC=162.142.125.241 DST=my_server_ip PROTO=TCP SPT=59327 DPT=8192
Mar 17 14:35:55 [UFW BLOCK] IN=eth0 SRC=185.191.34.207 DST=my_server_ip PROTO=TCP SPT=57129 DPT=44821
Mar 17 14:36:12 [UFW BLOCK] IN=eth0 SRC=208.81.183.241 DST=my_server_ip DF PROTO=UDP SPT=17242
Mar 17 14:36:53 [UFW BLOCK] IN=eth0 SRC=211.57.156.176 DST=my_server_ip PROTO=TCP SPT=54502 DPT=23
Mar 17 14:37:01 [UFW BLOCK] IN=eth0 SRC=89.248.165.60 DST=my_server_ip PROTO=TCP SPT=38892 DPT=30006
Mar 17 14:37:17 [UFW BLOCK] IN=eth0 SRC=162.142.125.84 DST=my_server_ip PROTO=TCP SPT=18754 DPT=10250
Mar 17 14:37:21 [UFW BLOCK] IN=eth0 SRC=124.222.7.230 DST=my_server_ip DF PROTO=TCP SPT=58890
Mar 17 14:37:46 [UFW BLOCK] IN=eth0 SRC=192.241.212.14 DST=my_server_ip PROTO=TCP SPT=40309 DPT=83
Mar 17 14:38:24 [UFW BLOCK] IN=eth0 SRC=89.248.163.157 DST=my_server_ip PROTO=TCP SPT=41838 DPT=1889
Mar 17 14:38:34 [UFW BLOCK] IN=eth0 SRC=193.163.125.136 DST=my_server_ip PROTO=TCP SPT=58793 DPT=8080
Mar 17 14:38:45 [UFW BLOCK] IN=eth0 SRC=167.94.138.147 DST=my_server_ip PROTO=TCP SPT=21095 DPT=49153
Mar 17 14:39:00 [UFW BLOCK] IN=eth0 SRC=165.227.113.250 DST=my_server_ip PROTO=TCP SPT=40654 DPT=17084

I did some WHOIS-Queries on some of these IPs and they all originate from some dubious persons/companies from all over the world.

Answer 1

Not to be trite but "lots" is routine.

If the requests are getting blocked and you're not experiencing a service degradation from the incoming requests (suggesting a DoS) I wouldn't worry. Just make sure they don't get in, patch your systems, and don't expose sensitive services to the internet directly.

But let's look at a few in AlienVault Open Threat Exchange:

• 167.94.138.142 - Known Benign Scanner
• 167.248.133.152 - Known Benign Scanner
• 154.89.5.86 - Probably a malicious scanner but scanning a wide range of hosts and honeypots
• 92.255.85.237 - Probably a malicious scanner but also scanning a lot of hosts.
• 185.191.34.207 - Actor portscanning widely

You can look up others yourself.

Point being, I don't see any reason to think (from this limited log) that you're being targeted. You have a house and people are driving by and trying to peek through the window: it's just part of being on the public internet.