0

Earlier today google said that unusual traffic was emanating from my computer and gave me a captcha. I got curious and installed nethogs. Everything appears normal except for an unknown program running as root. It connects to seemingly random ip addresses using very high port numbers (from 40000-60000). The foreign ip rotates every few minutes. This is not happening on my other ubuntu computer.

I actually did a fresh install of ubuntu (moving from 14.04 to 16.04) and upon reboot the program is still there occasionally sending and receiving data. Attached is a screenshot. Please help me figure out what this traffic is! Have I been hacked?

enter image description here

  • Do you happen to have a dynamic DNS service or something of the sort? – Julie Pelletier May 25 '16 at 8:13
  • Try to do a full wireshark capture, or a 'tcpdump -v -s0 -X -i eth0 -w dump.bin -c 100000' . You can then look deeper into the traffic (dumped to file dump.bin). Also try "watch -t 'sudo netstat -navp --inet' " to find out which process is doing this. – gerhard d. May 25 '16 at 8:13
  • You should be able to list all processes using ports 40000-60000 with: netstat -tupan | awk -F' +|/' 'NR<=2 || ($7 >= 40000 && $7 <= 60000)' or netstat -tupan | awk 'NR<=2 || /[45][0-9][0-9][0-9][0-9]\//' if your awk doesn't support regexps as the field separator. – cas May 25 '16 at 8:15
  • btw, is your ubuntu box doing NAT or IP Masquerading for other hosts on the network? – cas May 25 '16 at 8:19
  • Thank you all for the advice, I am still confused however. When I watch "watch -t 'sudo netstat -navp --inet' " I never see the relevant ip addresses appear. I do see many 0.0.0.0:* entries and the PID/Program name reads as 1948/dnsmasq. To my knownledge my computer was not doing any odd dns stuff or ip masquerading. It's just a normal desktop. But could this be what's causing the weird nethog listings? – E. Wagner May 25 '16 at 8:35
0

Don't let the unknown TCP message confuse you ,Nethogs didn't have enough data for the connection to identify the process uniquely.

You can check the process through the following commands :

netstat -tulpn | grep 54617
netstat -tulpn | grep 37804

Do not worry the output will confirm that the tow ports doesn't have any process.

Also you can use unhide-tcp to find hiden process through the command unhide-tcp.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.