0

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:

/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15
utm ulogd[11342]:
id="2001"
severity="info"
sys="SecureNet"
sub="packetfilter"
name="Packet dropped"
action="drop"
fwrule="60002"
initf="eth1"
outitf="eth0"
srcmac="0:20:4d:81:60:5e"
dstmac="68:5:ca:2a:12:ba"
srcip="192.168.1.28"
dstip="144.76.96.172"
proto="6"
length="52"
tos="0x00"
prec="0x00"
ttl="127"
srcport="49242"
dstport="5222"
tcpflags="SYN"

What I understand is that host x.x.x.28 is sending a packet to 144.76.96.172 and it gets dropped. That is ok and as designed from the firewalls point of view.

But host .28 should not send anything to this IP address.

How could I identify the application or the process that is sending this packet? Whats tools could I use?

Added more infos as requested in the first comment:

But you've not told us anything about the architecture of the network or the hosts.

  • LAN network 192.168.1.x

  • gateway and DHCP: 192.168.1.1

  • NAT translation to WAN

Have you verified that 192.168.0.0 traffic only comes from your internal network?

The Firewall only has one LAN to watch. It does the DHCP and NAT. It is properly configured. But I do not know how I can verify this.

have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip?

I verified and it is. Win 7 64bit

  • From the way you have presented your question you may still have a long journey ahead of you. The information you've provided suggest that it may be a jabber client. But you've not told us anything about the architecture of the network or the hosts. Have you verified that 192.168.0.0 traffic only comes from your internal network? have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip? – symcbean Oct 1 '14 at 13:24
0

This entry also specify that this machine is trying to establish a TCP connection to port 5222 on the remote system. TCP 5222 is, usually, XMPP (Jabber).

The next step is typically to go on the machine and find out which application is trying to open that connection and if it's legitimate or not. How you do that depends entirely on the operating system you use, though.

  • Do you have a recommended tool for Win7 64bit? – caliph Oct 1 '14 at 14:05
  • netstat -ab can be helpful – schroeder Oct 1 '14 at 14:22
  • To use Netstat, you have to allow the connection to be established. You can start toying with NATing the destination to a local system and use netcat to allow the connection to be established but, frankly, if you don't know of any jabber client on this system, I'd treat it as compromised instead. – Stephane Oct 1 '14 at 15:33
  • I came to the same conclusion. No IM client is on the host installed. None of the 2 installed applications could be responsible for the traffic. I decieded to put a fresh image on the host. Thanks for your advice, anyway! – caliph Oct 1 '14 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.