Why the attack's ip address has a string 'dia'

Question

This is a record from netstat –lnt | grep ^tcp:

tcp        0      0 xx.xxx.xx.72:ssh        106.49.174.61.dia:55983 ESTABLISHED

"x" is hidden by me :)

my questions are:

• why does the address have a 'dia'?
• Has he already logged in my ubuntu server by sshd?
• How to ban this address?

Answer 1

This ip address, 106.49.174.61, belongs CHINACACHE.

xxx@xxx ~ $ whois 106.49.174.61
% [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

% Information related to '106.48.0.0 - 106.49.255.255'

inetnum:        106.48.0.0 - 106.49.255.255
netname:        CHINACACHE
descr:          Beijing Blue I.T Technologies Co.,Ltd.
descr:          Galaxy Building,No.10 jiuxianqiao ,chaoyang
descr:          District,beijing
country:        CN
admin-c:        YS1150-AP
tech-c:         DC1032-AP
mnt-by:         MAINT-CNNIC-AP
mnt-lower:      MAINT-CNNIC-AP
mnt-routes:     MAINT-CNNIC-AP
mnt-irt:        IRT-CNNIC-CN
status:         ALLOCATED PORTABLE
changed:        [email protected] 20110322
source:         APNIC

irt:            IRT-CNNIC-CN
address:        Beijing, China
e-mail:         [email protected]
abuse-mailbox:  [email protected]
admin-c:        IP50-AP
tech-c:         IP50-AP
auth:           # Filtered
remarks:        Please note that CNNIC is not an ISP and is not
remarks:        empowered to investigate complaints of network abuse.
remarks:        Please contact the tech-c or admin-c of the network.
mnt-by:         MAINT-CNNIC-AP
changed:        [email protected] 20110428
source:         APNIC

CHINACACHE is ISP and in most cases sufix dia mean Dynamic Ip Address. ISP uses large public ip address pools for users of ISP services [adsl, 3g, wless ... ].

First you must disconnect this ip.

netstat -ntp will give you a PID of process witch you can kill

xxx@xxx ~ $ netstat -ntp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:53118         127.0.0.1:27117         ESTABLISHED -               
tcp        0      0 xxx.xxx.xx.x:39049      xx.xxx.xx.xxx:443       ESTABLISHED 13261/chrome    
tcp        0      0 xxx.xxx.xx.x:39048      xx.xxx.xx.xxx:443       ESTABLISHED 13261/chrome    

For example you can see two process from my pc witch im make chrome

For killing process aka disconnecting you can use

sudo kill -9 PID

Now you must prevent unwelcome connection to you pc. Start firewall.

sudo ufw start

When start firewall all connection to pc will be prohibited. If you wish to allow access from specific ip on net range you can use this template of command to make you rule.

ufw [--dry-run] [delete] [insert NUM]  allow|deny|reject|limit  [in|out
       on INTERFACE] [log|log-all] [proto protocol] [from ADDRESS [port PORT]]
       [to ADDRESS [port PORT]]

Example

sudo ufw allow proto tcp from xxx.xxx.xx.x port 22 to yyy.yyy.yy.y port 22

This rule allow access from xxx.xxx.xxx.xxx to your pc on address yyy.yyy.yy.y on port 22 witch is for ssh

sudo ufw allow proto tcp from xxx.xxx.xx.0/24 port 80 to xxx.xxx.xx.x port 80

This rule allow subnet xxx.xxx.xx.0 with network mask 255.255.255.0 access to your pc on port 80 aka http traffic