2

I have a vps server that is blocking me every hour via ip with its firewall. Looking the logs several messages like these where found:

Dec 16 13:52:08 srv kernel: [17226167.610181] Firewall: UDP_IN Blocked IN=venet0 OUT= MAC= SRC=201.202.151.176 LEN=60 TOS=0x00 PREC=0x00 TTL=1 ID=494 PROTO=UDP SPT=59052 DPT=33479 LEN=40

Looks like this indicates attempted contact on ports from 33479 to 33511 from my local pc without my feelingly. This rage of ports are not allowed to connect from remote connections. That is why the firewall block me.

I am running Fedora 20. I have thought that maybe a virus (not sure if fedora can catch virus) is trying to connect to my server using a malicious program. So, is there a way to look what program/script is trying to connect remotely to the server using that ports?

3

You can use lsof -i -n and, if needed, grep the desired port number on your local machine. This would give you the following output:

sshd       6076     root    3u  IPv4 2357620      0t0  TCP 10.11.1.76:ssh->10.11.100.181:55728 (ESTABLISHED)
sshd       6082   myuser    3u  IPv4 2357620      0t0  TCP 10.11.1.76:ssh->10.11.100.181:55728 (ESTABLISHED)

You can then check the process, PID, user and so on...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.