1

To verify this, I boot my PC from Kali Linux live distro. Before establishing ADSL/PPP connection, I start Wireshark and listen on any pseudo device. Then I create the connection to ISP network. Wireshark shows PPP handshake as expected.

Then, suddenly, I see incoming packets. This is a clean Kali Linux boot. I haven't started browsing or activated any services yet.

For example, I can see an incoming from ip 77.234.45.55 port 80 to my port 10051. This is what Wireshark shows:

TCP
  Source port: http (80)
  Destination port: 10051
  [Stream index: 0]
  Sequence number: 1 (relative sequence number)
  Acknowledgement number: 1 (relative sequence number)
  Header length: 20 bytes
  Flags: 0x11 (FIN, ACK)
  Window size value: 4824
  [Window size scaling factor: -1 (unknown)]
  Checksum: 0xb6f7 [Validation disabled]

I can see that my IP responds with RST packet.

Another example of incoming packet is UDP from 220.160.203.187 from port 25041 to mine port 18843. This is what Wireshark shows:

UDP
   Source port: 25041
   Destination port: 18843
   Length: 70
   Checksum: 0xe107 [validation disabled]
[Malformed Packet: BT-uTP]

Wireshark shows that my system responds this packet with an ICMP 3 code 3 packet (Destination Unreachable: Port unreachable).

Another example of incoming packet is:

TCP
   Source port: xmpp-client (5222)
   Destination port: 22784
   [Stream index: 1]
   Sequence number: 1 (relative sequence number)
   [Next sequence number: 27 (relative sequence number)]
   Acknowledgement number: 1
   Header length: 20
   Flags: 0x0x18 (PSH, ACK)
   Window size value: 42243
   [Calculated window size: 42243]
   [Window size scaling factor: -1 (unknown)]
   Checksum: 0x12a4 [validation disabled]
   [SEQ/ACK Analysis]
      [Bytes in flight: 26]

I believe these incoming packets is from legitimate servers. I can always reproduce this behaviour which result in different incoming packets. I don't have clue why they sent packets (or redirected) to me. Is this a normal behaviour in ADSL network? Should I do something regarding these packets?

  • How long have you had this IP address? You may be seeing connection attempts from the previous "owner". Other than that, it's probably just junk. – mirimir Feb 18 '14 at 4:13
1

"Always on" connections or not does not matter. There is so much junk traversing the Internet anymore that it would be impossible to find an IP anymore that doesn't receive something everyday and this has nothing to do with if your system reached out to the Internet or not.

What you're experiencing is the just how the Internet is. This is normal.

1

ADSL is an "always-on connection to the Internet". If you are getting these packets then it will be a normal behaviour.After doing nslookup the response is

**nslookup 77.234.45.55
Server:     127.0.0.1
Address:    127.0.0.1#53
Non-authoritative answer:
55.45.234.77.in-addr.arpa   name = r-055-045-234-077.ff.avast.com.
Authoritative answers can be found from:
45.234.77.in-addr.arpa  nameserver = s.ns.avast.com.
45.234.77.in-addr.arpa  nameserver = y.ns.avast.com.**

It is obvious that your system is sending RST packets in response because of the system didn't send any request.You need not to worry. You can also see this post for solving your problem http://prg-forum-01.avast.com/index.php?topic=9898.0/index.php?topic=9898.0

  • Thank for your answer. Would you like to add references that confirm getting these packets in ADSL is normal? I'm using clean Kali Linux and it doesn't have Avast installed. – David Bower Dec 18 '13 at 13:06
  • 1
    @DavidBower that may be because your IP has previously connected to Avast's servers (either by you on your Windows OS or by the previous owner of the IP if your IP is dynamic). – user42178 Mar 19 '14 at 18:35
1

The first connection it is probably your antivirus or a browser getting the flags for closing the socket. I can't tell you anything useful for the UDP traffic (just that comes from China). But the last one is a packet coming from a Jabber server (Gtalk?).

Usually, when you connect something with a public IP, you will get tons of connections, scans, etc. Most of the time coming from infected servers and users.

  • Thank for your answer. I didn't open any browser yet and there is no antivirus in clean Kali Linux. At first, I think these are infected servers. But after performing nmap scan, I believe most of them are legitimate servers (for example the antivirus server). – David Bower Dec 18 '13 at 13:11
  • Nmap will not reveal infections under typical circumstances (only in the case of exploitation that opens a port that nmap can see can it determine infection - the person scanning would need to know if the port should open or not prior to exploitation) or determine "legitimacy". Furthermore, you should not be nmapping systems that are not under your control. However, since you mentioned it that's a prime example of what you're experiencing... infected systems hitting your IP at random, people randomly nmapping - just as you did - looked for hosts to attack. – user1801810 Mar 26 '14 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.