To verify this, I boot my PC from Kali Linux live distro. Before establishing ADSL/PPP connection, I start Wireshark and listen on any pseudo device. Then I create the connection to ISP network. Wireshark shows PPP handshake as expected.
Then, suddenly, I see incoming packets. This is a clean Kali Linux boot. I haven't started browsing or activated any services yet.
For example, I can see an incoming from ip 220.127.116.11 port 80 to my port 10051. This is what Wireshark shows:
TCP Source port: http (80) Destination port: 10051 [Stream index: 0] Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative sequence number) Header length: 20 bytes Flags: 0x11 (FIN, ACK) Window size value: 4824 [Window size scaling factor: -1 (unknown)] Checksum: 0xb6f7 [Validation disabled]
I can see that my IP responds with RST packet.
Another example of incoming packet is UDP from 18.104.22.168 from port 25041 to mine port 18843. This is what Wireshark shows:
UDP Source port: 25041 Destination port: 18843 Length: 70 Checksum: 0xe107 [validation disabled] [Malformed Packet: BT-uTP]
Wireshark shows that my system responds this packet with an ICMP 3 code 3 packet (Destination Unreachable: Port unreachable).
Another example of incoming packet is:
TCP Source port: xmpp-client (5222) Destination port: 22784 [Stream index: 1] Sequence number: 1 (relative sequence number) [Next sequence number: 27 (relative sequence number)] Acknowledgement number: 1 Header length: 20 Flags: 0x0x18 (PSH, ACK) Window size value: 42243 [Calculated window size: 42243] [Window size scaling factor: -1 (unknown)] Checksum: 0x12a4 [validation disabled] [SEQ/ACK Analysis] [Bytes in flight: 26]
I believe these incoming packets is from legitimate servers. I can always reproduce this behaviour which result in different incoming packets. I don't have clue why they sent packets (or redirected) to me. Is this a normal behaviour in ADSL network? Should I do something regarding these packets?