1

I recently noticed a strange set of UDP packets I can't account for.

Every 9 seconds I receive a UDP packet from 156.146.58.62 : port 1197 .

The packet is always 41 bytes of binary data, which changes with every packet.

Port 1197 is nominally "carrius r-shell" for remote access.

I can't find any useful information about 156.146.58.62 .

I first noticed it because my system was responding with ICMP Unreachable messages. I have since black-holed the IP with iptables, so no more ICMP messages.

Although the packet is now being dropped, I can still see that the packet is still arriving every 9 seconds. My machine is behind a NAT, it is not in the DMZ, and there are no router forwarding rules.

So why/how am I seeing this packet?

The only thing I can think is that I have some application like Zoom or Skype that's initiating the NAT dynamic port allocation and the 9 second repetition from 156.146.58.62 is holding it open?

Any insights?

3
  • If it's coming to your NAT PC it is almost definitely some sort of UPNP at play - this could be Skype, Zoom or even Bittorrent. Commented Nov 26, 2020 at 19:57
  • According to whois that iP belongs to DataCamp which seems to be a hosting provider in the UK. Does that ring a bell with you?
    – Nils
    Commented Nov 26, 2020 at 21:14
  • @Nils - Nope, I saw that it's a hosting provider but it means nothing to me. Commented Nov 26, 2020 at 23:56

1 Answer 1

0

I'm pretty sure I found it.

I NMAP'd it and made the connect.

PORT     STATE SERVICE    VERSION
80/tcp   open  http?
443/tcp  open  openvpn    OpenVPN
8443/tcp open  https-alt?

No exact OS matches for host

PIA (Private Internet Access) revamped their service structure under new ownership. Their UDP VPN servers generally use port 1197.

I was unable to find a particular server DNS for this IP, but after power cycling my router I no longer see the packet inside the NAT. I haven't checked the router logs.

I suspect this is an old server, possibly overlooked or misconfigured remnant.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .