0

Earlier today google said that unusual traffic was emanating from my computer and gave me a captcha. I got curious and installed nethogs. Everything appears normal except for an unknown program running as root. It connects to seemingly random ip addresses using very high port numbers (from 40000-60000). The foreign ip rotates every few minutes. This is not happening on my other ubuntu computer.

I actually did a fresh install of ubuntu (moving from 14.04 to 16.04) and upon reboot the program is still there occasionally sending and receiving data. Attached is a screenshot. Please help me figure out what this traffic is! Have I been hacked?

enter image description here

8
  • Do you happen to have a dynamic DNS service or something of the sort? May 25, 2016 at 8:13
  • Try to do a full wireshark capture, or a 'tcpdump -v -s0 -X -i eth0 -w dump.bin -c 100000' . You can then look deeper into the traffic (dumped to file dump.bin). Also try "watch -t 'sudo netstat -navp --inet' " to find out which process is doing this.
    – gerhard d.
    May 25, 2016 at 8:13
  • You should be able to list all processes using ports 40000-60000 with: netstat -tupan | awk -F' +|/' 'NR<=2 || ($7 >= 40000 && $7 <= 60000)' or netstat -tupan | awk 'NR<=2 || /[45][0-9][0-9][0-9][0-9]\//' if your awk doesn't support regexps as the field separator.
    – cas
    May 25, 2016 at 8:15
  • btw, is your ubuntu box doing NAT or IP Masquerading for other hosts on the network?
    – cas
    May 25, 2016 at 8:19
  • Thank you all for the advice, I am still confused however. When I watch "watch -t 'sudo netstat -navp --inet' " I never see the relevant ip addresses appear. I do see many 0.0.0.0:* entries and the PID/Program name reads as 1948/dnsmasq. To my knownledge my computer was not doing any odd dns stuff or ip masquerading. It's just a normal desktop. But could this be what's causing the weird nethog listings?
    – E. Wagner
    May 25, 2016 at 8:35

1 Answer 1

0

Don't let the unknown TCP message confuse you ,Nethogs didn't have enough data for the connection to identify the process uniquely.

You can check the process through the following commands :

netstat -tulpn | grep 54617
netstat -tulpn | grep 37804

Do not worry the output will confirm that the tow ports doesn't have any process.

Also you can use unhide-tcp to find hiden process through the command unhide-tcp.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .