Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've just installed Ubuntu Server on my home box after becoming partially familiar with it at work and wanting to train up as a Pen Tester.

I installed the latest version on a logical partition (the main one contained Win7), and selected none of the extra modules (I think). I installed ngrep and fired it up (along with TCPdump) and immediately saw some strange traffic which I am unable to identify.

My pc is sending out UDP packets every couple of seconds to a seemingly random series of IP addresses, all on the same port (47669 - though I did also see it use another port for a while).

I watched it do this for about 20 mins, whilst trying to work out why it was doing it. The only other traffic was the odd ARP request for the router and SSDP UPnP broadcasts from the router.

Anyone know what this is, or have any advice on how best to find out?

Thanks.

EDIT: Actually, it's not my box generating the traffic. It's receiving the traffic on that port, from a series of IP addresses, and returning 'port unreachable' messages.

share|improve this question
    
Could you attach a few lines of packet log to your question? Also netstat -a might shed some light to what is listening on that port. –  lgarzo Apr 5 '12 at 9:14
    
I'll see what I can do. Only got the one box for Linux and Windows, so not sure if I can transfer files. I'll see if I can work out what's listening on my end though, good idea. To clarify my original question, nothing is listening on the IPs that my box is sending messages to. –  Fishy Apr 5 '12 at 9:50
    
Okay, I took a pcap of the behavior. Can someone tell me how to attach it? Also, nothing seems to be listening for replies on the specified port. –  Fishy Apr 5 '12 at 10:10
    
You can either include a few lines as code by editing the question or (if it's large) use paste.ubuntu.com and post the paste's URL in your question. –  lgarzo Apr 5 '12 at 10:39
    
Okay, thanks. Having looked at the traffic in Wireshark, it became clear that I was actually mistaken when I thought that it was my box generating the traffic. It seems to be receiving traffic on that port and replying with 'port unreachable' messages. Is this just some rogue internet entity probing my system then? My firewall seems to be set to disallow incoming traffic. paste.ubuntu.com/915843 –  Fishy Apr 5 '12 at 11:04
show 2 more comments

1 Answer

up vote 0 down vote accepted

Your Packet #48 seems to be bittorrent related.

Compare:

0000  64 31 3a 61 64 32 3a 69 64 32 30 3a fe 2a 2f 4a   d1:ad2:id20:.*/J
0010  2d ce be 0b 3b 0c 9f 41 e8 9e 04 56 b3 d7 be ce   -...;..A...V....
0020  65 31 3a 71 34 3a 70 69 6e 67 31 3a 74 32 3a 04   e1:q4:ping1:t2:.
0030  8e 31 3a 76 34 3a 4c 54 00 0f 31 3a 79 31 3a 71   .1:v4:LT..1:y1:q
0040  65                                                e

With:

announce_peers Query = {"t":"aa", "y":"q", "q":"announce_peer", "a":
    {"id":"abcdefghij0123456789", "info_hash":"mnopqrstuvwxyz123456", "port": 6881, 
     "token": "aoeusnth"}}
bencoded = d1:ad2:id20:abcdefghij01234567899:info_hash20:<br />mnopqrstuvwxyz1234564:
     porti6881e5:token8:aoeusnthe1:q13:announce_peer1:t2:aa1:y1:qe

Source: http://bittorrent.org/beps/bep_0005.html

While I cannot be sure for the other shorter packets, it is very likely similar noise.

share|improve this answer
    
Since I'm not running any torrent software on Ubuntu, do you have any idea why all these random IP addresses would be sending me bittorrent data? –  Fishy Apr 5 '12 at 11:35
    
Did/do you have any host/user behind your router that might have used bittorrent sometime? –  lgarzo Apr 5 '12 at 11:55
    
I have used bittorrent sometime. Am I now doomed to receive random traffic from the whole internet forever? Eep! –  Fishy Apr 5 '12 at 12:21
    
I'm not an expert on the subject, so take it with a grain of salt. Some static always knocks at the firewall, (spambots, viruses, port scans and even P2P) therefore a well configured front end firewall is a good idea. But if you're on a dynamic IP, it could be the previous borrower of your address who caused this back traffic. –  lgarzo Apr 5 '12 at 12:29
    
I guess I'll try and tighten up my firewall. Thanks for all your help. –  Fishy Apr 5 '12 at 12:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.