New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Is this normal?
I use Logwatch to get daily log summary via email. Within few days, I have been noticing these:
Logged 4141 packets on interface eth0 From 0.0.0.0 - 287 packets to udp(67) From xx.xx.xx.xx - 646 packets to udp(17500) From xx.xx.xx.xx - 842 packets to udp(17500) From xx.xx.xx.xx - 506 packets to udp(67,17500) From xx.xx.xx.xx - 1 packet to udp(67) From xx.xx.xx.xx - 413 packets to udp(17500) From xx.xx.xx.xx - 1 packet to udp(67) From xx.xx.xx.xx - 727 packets to udp(67,17500) -----Similar Lines but on different ports and only one packet per IP -----
Other lines are just for 1 packets to different ports. Seems like there are massive number of packets to port 17500 and 67.
Is this normal? And, why was there a packet from 0.0.0.0?
Comments
Tip, use the pre tags
No, it is not normal to log all UDP packets
You are killing your server with all this logging.
Port 67 is normal - it is dhcp. When you are in a shared segment and there are machines setup to get their IPs via dhcp - you will see a lot of these.
What about Port 17500?
According to google it is some sort of dropbox lan client sync. Perhaps you are on a lan with windows boxes.
On a KVM VPS?
Yes, probably.
IPs aren't from the same subnet but are from the same DC.
So they are running one big flat LAN. Asking for trouble.
Shouldn't Dropbox LAN sync be broadcasting only on a subnet on which it belongs?
Dude one gets 1000s of portscans every day. Just disable the annoying logwatch email and you'll be fine.
Do Portscanners generate that much packets to a single port to just check whether it is open or not?
I am disabling the whole iptables logging thing.
Or small subnets are routed to the node every time more ip are needed
Yeah, that would be the far better approach
Sure, if you get portscanned 700 times a day and each portscanner tries the port one time.
It's getting 700 packets from 1 IP.
Now imagine your server gets targeted by UDP flood for a couple of hours. The log will be nicely filled.