0

I am doing some egress monitoring on my computer. Once in every few days, I would find some strange connections being logged, which I believe is initiated by the web browser through a related but not established HTTP(S) connection.

IN= OUT=eth0 SRC=192.168.1.2 DST=54.242.237.165 PROTO=TCP SPT=33001 DPT=843 SYN URGP=0
IN= OUT=eth0 SRC=192.168.1.2 DST=69.46.36.10 PROTO=TCP SPT=57002 DPT=4000 SYN URGP=0

Should there be any cause for concern, security wise, about these sporadic connections being made on non-standard ports (i.e. not 80,443)?

1

What you should do is resolve the IP addresses to see who uses them and check (IANA) port designations. Then adding audit rules (only for local clients though) gives you at least a time stamp, process and user Id, forcing clients through a proxy gets you at least a time stamp and host name and capturing packets (ulogd, tcpdump, Snort rule) may provide session details. Combined that should provide a better basis for analysis as an IP address and port combo alone doesn't necessarily prove much these days.

|improve this answer|||||
  • I have omitted the timestamp and userid 1000 from the above iptables log. Don't have the process id but I suspect it is the browser based on the timestamp. I have tried host on the two IP addresses, but didn't yield much clue. Assuming that it is the browser, is there any risk or should I allow it to initiate connection from any port? – Question Overflow Sep 8 '14 at 2:31
  • I have provided you with the methods allowing you to provide more detailed information, which in turn allows us to answer the question in a more detailed way. Please ponder why just rephrasing your question, that is: without providing new additional details, does not work. – unSpawn Oct 11 '14 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.