3

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number:

Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 MAC=xx:xx:xx SRC=abc.a.b.c DST=xyz.x.y.z LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=16405 PROTO=TCP SPT=80 DPT=61412 WINDOW=16384 RES=0x00 ACK SYN URGP=0 
Jul 09 01:29:42 example.com kernel: IPTABLES: IN=eth1 MAC=xx:xx:xx SRC=abc.a.b.c DST=xyz.x.y.z LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=31270 PROTO=TCP SPT=80 DPT=61412 WINDOW=16384 RES=0x00 ACK SYN URGP=0 
Jul 09 01:32:41 example.com kernel: IPTABLES: IN=eth1 MAC=xx:xx:xx SRC=abc.a.b.c DST=xyz.x.y.z LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=43052 PROTO=TCP SPT=80 DPT=61412 WINDOW=16384 RES=0x00 ACK SYN URGP=0 
Jul 09 01:34:40 example.com kernel: IPTABLES: IN=eth1 MAC=xx:xx:xx SRC=abc.a.b.c DST=xyz.x.y.z LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=53328 PROTO=TCP SPT=80 DPT=61412 WINDOW=16384 RES=0x00 ACK SYN URGP=0

This has been going on for a day and the connection is made every 5 minutes or so. I tried accessing the site from its IP address but it says connection reset. nslookup gives a non-authoritative answer:

Non-authoritative answer:
xyz.x.y.z.in-addr.arpa  name = xyz.x.y.z.static.eigbox.net.

It appears that someone could be spoofing my server's ip address, causing this remote computer to respond by sending ACK SYN packages to my server. I even log the iptables output to this IP address to ensure that my server is not responding to it.

Is it possible to find out what a remote user is trying to do connecting to a closed port without compromising my server's security?

3

If I'm reading that log correctly, you're seeing backscatter from a spoofed-packet denial-of-service attack (possibly a SYN flood) against a webserver running on abc.a.b.c. The constant destination port and exact-multiples-of-a-minute timing is a bit odd, though.

The log is showing SYN/ACK packets (that is, the second stage in a TCP three-way handshake) coming from port 80 to a port in the private range. That means the server received a packet to port 80 that claimed to be from your address; if it's part of an attack, the attacker is using forged addresses to hide where the attack is coming from and make it harder to block.

As for seeing what they're doing, you could use Wireshark or another packet-sniffing program to look at what's inside those packets, but I doubt you'll find anything interesting.

  • Wireshark will show you what you need to know. – schroeder Jul 9 '14 at 14:53
  • If it's a syn/ack packet how much are you going to see in body of the packet? I wouldn't expect to see anything interesting until the handshake is complete and the far side starts sending data. – u2702 Jul 9 '14 at 15:24
  • Yes, I find it quite strange that the remote webserver keep sending packets to a constant port. Thanks for your suggestion, I will take a look at using wireshark when I have time. – Question Overflow Jul 10 '14 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.