2

today my Ubuntu 12.04 pc crashed and I had to force kill it, which it never does. Then after booting back up I ran wireshark and saw random dns requests and a protocol I've never seen before 'dec dna' as well a lot of weird udp streams. I ran

netstat -la and this was the output:

root@linuxbox:~# netstat -la
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 localhost:domain        *:*                     LISTEN     
tcp        0      0 *:ssh                   *:*                     LISTEN     
tcp        0      0 localhost:ipp           *:*                     LISTEN     
tcp        0      0 localhost:mysql         *:*                     LISTEN     
tcp        0      0 *:http                  *:*                     LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
tcp6       0      0 ip6-localhost:ipp       [::]:*                  LISTEN     
udp        0      0 *:1900                  *:*                                
udp        0      0 *:40322                 *:*                                
udp        0      0 localhost:domain        *:*                                
udp        0      0 localhost:ntp           *:*                                
udp        0      0 *:ntp                   *:*                                
udp        0      0 *:mdns                  *:*                                
udp6       0      0 fe80::7879:ff:fe00::ntp [::]:*                             
udp6       0      0 fe80::12fe:edff:fe2:ntp [::]:*                             
udp6       0      0 fe80::216:6fff:fe4d:ntp [::]:*                             
udp6       0      0 ip6-localhost:ntp       [::]:*                             
udp6       0      0 [::]:ntp                [::]:*                             
udp6       0      0 [::]:47318              [::]:*                             
udp6       0      0 [::]:mdns               [::]:*                
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     11019    /tmp/.X11-unix/X0
unix  2      [ ACC ]     STREAM     LISTENING     11618    /tmp/.winbindd/pipe
unix  2      [ ACC ]     STREAM     LISTENING     13721    /tmp/keyring-HyNZDz/control
unix  2      [ ACC ]     STREAM     LISTENING     13860    /tmp/ssh-COlALKGR2295/agent.2295
unix  2      [ ACC ]     STREAM     LISTENING     13890    /tmp/.ICE-unix/2295
unix  2      [ ACC ]     STREAM     LISTENING     14080    /tmp/keyring-HyNZDz/pkcs11
unix  2      [ ACC ]     STREAM     LISTENING     14084    /tmp/keyring-HyNZDz/ssh
unix  2      [ ACC ]     STREAM     LISTENING     14085    /tmp/keyring-HyNZDz/gpg
unix  2      [ ACC ]     STREAM     LISTENING     10790    /var/run/acpid.socket
unix  2      [ ACC ]     SEQPACKET  LISTENING     7973     /run/udev/control
unix  19     [ ]         DGRAM                    10025    /dev/log
unix  2      [ ACC ]     STREAM     LISTENING     7850     @/com/ubuntu/mountall

...and many, many more i cant fit here.

... can anyone tell me what those odd listening services are? I had a web server on my home lan and just today moved it to a vps for security reasons. I had noticed strange things going on with the network before week, but this seems abnormal. I've just never seen this before. Can someone help me? Rkhunter does not seem to find anything. I logged into my openvpn, ran wireshark again and noticed ssh connections from random ips. I ran 'who' and nobody else was here. But then wireshark started displaying tcp redirect of my openvpn traffic, repeatedly until I killed the connection. I should note that this is also now happening on my other ubuntu computer, which is on the same network.

I no longer require assistance with this. A little more digging has informed me that these are normal services, and that the output of ls -la and ls -a are not the same thing... I have not slept in two days, so forgive my ignorance.

2
  • Since you obtained an answer you should put it below and mark it as correct (once the waiting time passes).
    – willl459
    Apr 2, 2014 at 3:08
  • Oops! I'm late, you got your answer.
    – Mayura
    Apr 2, 2014 at 3:15

1 Answer 1

2

Those are very normal listening services running, nothing suspicious appears!

Explanation of those listening ports and sockets,

  • *:ssh is SSH server listening on 22 [accessible on ALL IPs]
  • *:http is Web Server listening on 80 [accessible on ALL IPs]
  • localhost:domain is DNS resovler listening on 53 [accessible locally] [safe]
  • localhost:ipp is cpusd (printing stuff) listening on 631 [accessible locally] [safe]
  • localhost:mysql is MySQL as it says listening on 3306 [accessible locally] [safe]

  • mdns and ntp are associated with DNS and Network Time.

  • All Unix sockets/stream also appears normal, these are commonly found sockets.

To check Live DNS Query ( -i <2> interface number.)

tshark -D (To list interfaces)

time tshark -n -i 2 -R "dns.flags.response == 0" | tee ~/dns.log; wc ~/dns.log

less ~/dns.log (go through logs manually)

Though, I would recommend you to investigate more into network traffic, as you mentioned that you observed many DNS redirection, so to digg into more, check content transmitted, source/destination address and respective port, which should provide more insight on what exactly is causing redirection.

4
  • Yes, this is the correct answer. I misinterpreted listening ports for active connections, and that coupled with the strange redirects and dns queries made me panic a bit. Are there any analysis methods that I could utilize to figure out why/how my non encrypted AND openvpn traffic could be redirected to random ips? I've ran a lot of nmap scans over the lans (i have two networks, a server dmz/guest network and a private for myself) and poured over wireshark pcap logs, but I don't know how to figure out what's actually IN the payload, verses how, to and from where the packets were transmitted.
    – Chev_603
    Apr 2, 2014 at 3:38
  • Most commonly traffic to random IP happens with P2P, do you use any service like Torrent, Bitcoin, TOR or something? Even tunneling through VPN connection gets skipped and such P2P services start connecting directly to hosts in some cases. Collaborating information via tools such as wieshark/tshark, nmap, netstat, whois, dig, lsof, tcpdump would help you gather more information. Give it a try.
    – Mayura
    Apr 2, 2014 at 7:09
  • Yes, I do use bittorrent tunneled through a sox proxy, and I have noticed that sometimes after i shut the torrent client off packets are still my way (same thing with Tor and bitcoin). I'm not sure, but I always thought that was because udp doesn't care whether it reaches its destination or not. I've heard that bittorent tends to ignore proxy settings. That's another issue of it's own. I have all aforementioned tools except dig and lsof, i'll look into that. Hey, thanks everyone for the support. This is a great community.
    – Chev_603
    Apr 2, 2014 at 18:07
  • Glad that you are now clear, keep sharing/spreading knowledge around :)
    – Mayura
    Apr 3, 2014 at 20:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .