incoming packets in server

Question

I have enabled iptables logging for packets coming from the outside

-A INPUT ! -s 192.168.218.0/24 -j LOG

Now i am seeing lots of incoming packets from unknown addresses

Jun  5 14:54:56 localhost kernel: [572504.888953] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=1500 TOS=0x00 PREC=0x00 TTL=55 ID=49833 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK URGP=0 
Jun  5 14:54:56 localhost kernel: [572504.916382] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=1500 TOS=0x00 PREC=0x00 TTL=55 ID=49834 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK URGP=0 
Jun  5 14:54:56 localhost kernel: [572504.916425] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=1000 TOS=0x00 PREC=0x00 TTL=55 ID=49835 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK PSH URGP=0 
Jun  5 14:54:56 localhost kernel: [572505.051902] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=1500 TOS=0x00 PREC=0x00 TTL=55 ID=49836 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK URGP=0 
Jun  5 14:54:56 localhost kernel: [572505.184949] IN=eth1 OUT= MAC=... SRC=91.189.88.140 DST=192.168.218.101 LEN=52 TOS=0x00 PREC=0x00 TTL=55 ID=49837 DF PROTO=TCP SPT=80 DPT=47954 WINDOW=295 RES=0x00 ACK FIN URGP=0 
Jun  5 14:55:05 localhost kernel: [572513.916617] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=29430 DF PROTO=TCP SPT=80 DPT=45598 WINDOW=62 RES=0x00 ACK FIN URGP=0 
Jun  5 14:55:14 localhost kernel: [572523.037537] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=45598 WINDOW=62 RES=0x00 ACK URGP=0 
Jun  5 14:55:35 localhost kernel: [572544.026368] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=48218 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
Jun  5 14:55:35 localhost kernel: [572544.149415] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=451 TOS=0x00 PREC=0x00 TTL=52 ID=20682 DF PROTO=TCP SPT=80 DPT=48218 WINDOW=63 RES=0x00 ACK PSH URGP=0 
Jun  5 14:55:50 localhost kernel: [572559.133253] IN=eth1 OUT= MAC=... SRC=64.34.119.12 DST=192.168.218.101 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=20683 DF PROTO=TCP SPT=80 DPT=48218 WINDOW=63 RES=0x00 ACK FIN URGP=0 

I've disabled all port forwarding from my router (ssh 22 and openvpn 1194), so i don't understand how these packets are making it to the 192.168.218.101 box (my computer called 'localhost')

i've tried adding tcpdump to investigate these packets with

sudo tcpdump "(dst net 192.168.218.0/24 and ! src net 192.168.218.0/24)"

but it does not return a single line of output

any idea why these packets are making it through the router? the router is a home D-Link Dir-600, i've disabled port forwarding and no firewall rules, DMZ disabled

what sort of diagnostics can i make to know what is the payload in these packets? why tcpdump does not show anything?

Answer 1

The source addresses are not totally unknown: the first one is from canonical.com, which hosts Ubuntu packages (therefore I suppose that your system runs Ubuntu, and currently tries to see whether there are available updates for your installed packages). The second address is stackoverflow.com, a well-known site in these parts. Most probably, these packets are just part of client connections from your computer to the Internet at large, for which your router runs NAT (which is its primary job). Port forwarding is for incoming connections (from outside to your system).

The log shows that the packets go through your eth1 network adapter. On a Linux system, this is the second adapter, the first one being eth0 (possibly, you have an ethernet interface and a WiFi adapter, and you use the latter). tcpdump uses eth0 by default, which would explain why you see no packet with it. Try using the -i option for tcpdump (see the man page).

Answer 2

Just to add to @Thomas' response. the packets you've got in that capture look to be responses to requests from your machine for a couple of reasons.

Ports. They've got source port 80 destination port [something in the high range] . that's a typical pattern for a connection to a webserver from your machine (thus likely that these packets are responses.

Also TCP flags. the ACK flag being specified usually indicated (assuming that someone's not generating artificial traffic) an ongoing part of a TCP connection. If the connections were new ones (typically if someone was trying to connect to a service running on your machine) you'd see the SYN flag set.