1

I've got several computers with Debian Buster (Gnome) installed. Thanks to psad tool I realized that all of them frequently (at least several times a day) scan udp ports 8610-8612 in the local network.

I wonder what is the purpose of this? What package or service does that? DuckDuckGoing didn't help and I have no idea how to get into this.

I blocked outgoing connections on those ports on some of the computers using firewall and didn't notice any malfunction of any part of the system.

Below you can see a part of psad-alert e-mail:

         Danger level: [3] (out of 5)

    Scanned UDP ports: [8610-8612: 4 packets, Nmap: -sU]
       iptables chain: INPUT (prefix "[UFW BLOCK]"), 4 packets

There is something that may (or may not) be relevant - psad alerts show ipv6 of the source and target, while we generally use only ipv4 in the LAN.

3
  • 2
    Could be anything, trying to look for a service on that port, also you can try to put a process with netcat/nc listening on that ports and dump the output in order to see the layer7 that the source is using.
    – camp0
    Jun 13, 2019 at 7:55
  • Could be related to this report of Canon MFP devices sending multicast traffic on port 8610: community.usa.canon.com/t5/Wireless-Networking/…
    – bonsaiviking
    Jun 13, 2019 at 18:52
  • Could it be Avahi? Just a random idea. What does tcpdump show?
    – Rui F Ribeiro
    Jun 13, 2019 at 21:37

2 Answers 2

Reset to default
4

I'm not using Debian or Ubuntu so I can't check this, but it might be related to the printing service CUPS. There is a confirmed bug in Ubuntu which reports a problem with the cups-browsed service sending a large amount of UDP requests on ports 8610 and 8612.

You could try to stop any CUPS service and see if the scans stop.

2
  • 1
    Thanks for the lead - I'm going to check this and let you know about the outcome.
    – Stanowczo
    Jun 13, 2019 at 12:45
  • I followed the thread you linked and my problem looks exactly as described there. Funny thing which I read there is that connecting any USB device triggers port scanning - I didn't recognize this before. Unfortunately the issue is not resolved... But it's probably not cups-related after all (I tried disabling cups-browsed, didn't help).
    – Stanowczo
    Jul 16, 2019 at 6:10
0

I had the same issue. A comment at the Ubuntu bug page (linked by dr01) lead me to colord (instead of cups) and stopping colord seems to have fixed it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .