0
13:06:05.345111 IP 192.168.1.101.36218 > 157.55.130.174.40033: Flags [.], ack 162, win 237, options [nop,nop,TS val 688796 ecr 596714815], length 0

This IP address is Allocated Unspecified on ripe.net and there are many connections today.

I'm running Ubuntu 14.04 (always updated to the latest).

1 Answer 1

4

Just because the IP shows as Allocated unspecified does not mean you are being hacked.

This IP status is because you asked the wrong entity, as ripe.net is not the responsible for allocating that IP. If you look at IANA IPv4 Address Space Registry, you would see that this IP range is managed by ARIN.

If you ask arin.net, you would see that the IP is owned by Microsoft Corporation.

4
  • thank you for the explanation and support. Can I ask why my Ubuntu/linux system is calling at Microsoft Corporation? :-) ...is it something strange? Now I've installed FireStarter and I can see all these connections to 212.45.144.88/91.189.94.4/etc on 123/53 ports... these all seems to be around the time sync or something.
    – Faciunt
    Oct 14, 2014 at 16:04
  • Port 53 is usually DNS requests. The connection to 157.55.130.174 is an HTTP request. You can run wireshark and see what is being transmitted.
    – ThoriumBR
    Oct 14, 2014 at 16:17
  • thanks to ThoriumBR. I used tcpdump but I'm trying wireshark now. Why can I see a lot of connections on tcpdump without any event on firestarter?
    – Faciunt
    Oct 14, 2014 at 16:37
  • I'm wondering if there is a website to query all the available databases (ripe.net, airin.net, etc) to gather information about an IP in only one query. thank you.
    – Faciunt
    Oct 19, 2014 at 8:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .