1

I've got several computers with Debian Buster (Gnome) installed. Thanks to psad tool I realized that all of them frequently (at least several times a day) scan udp ports 8610-8612 in the local network.

I wonder what is the purpose of this? What package or service does that? DuckDuckGoing didn't help and I have no idea how to get into this.

I blocked outgoing connections on those ports on some of the computers using firewall and didn't notice any malfunction of any part of the system.

Below you can see a part of psad-alert e-mail:

         Danger level: [3] (out of 5)

    Scanned UDP ports: [8610-8612: 4 packets, Nmap: -sU]
       iptables chain: INPUT (prefix "[UFW BLOCK]"), 4 packets

There is something that may (or may not) be relevant - psad alerts show ipv6 of the source and target, while we generally use only ipv4 in the LAN.

  • 2
    Could be anything, trying to look for a service on that port, also you can try to put a process with netcat/nc listening on that ports and dump the output in order to see the layer7 that the source is using. – camp0 Jun 13 at 7:55
  • Could be related to this report of Canon MFP devices sending multicast traffic on port 8610: community.usa.canon.com/t5/Wireless-Networking/… – bonsaiviking Jun 13 at 18:52
  • Could it be Avahi? Just a random idea. What does tcpdump show? – Rui F Ribeiro Jun 13 at 21:37
2

I'm not using Debian or Ubuntu so I can't check this, but it might be related to the printing service CUPS. There is a confirmed bug in Ubuntu which reports a problem with the cups-browsed service sending a large amount of UDP requests on ports 8610 and 8612.

You could try to stop any CUPS service and see if the scans stop.

  • 1
    Thanks for the lead - I'm going to check this and let you know about the outcome. – Stanowczo Jun 13 at 12:45
  • I followed the thread you linked and my problem looks exactly as described there. Funny thing which I read there is that connecting any USB device triggers port scanning - I didn't recognize this before. Unfortunately the issue is not resolved... But it's probably not cups-related after all (I tried disabling cups-browsed, didn't help). – Stanowczo yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.