SSH connection and TCP packets

Question

I have an ssh server at IP YY.YY.YY.YY listening on port 5022 which shows the following traffic (with TCPDUMP) where XX.XX.XX.XX is an external UNKNOWN IP,

10:34:58.879055 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: S 1093512123:1093512123(0) win 29200 <mss 1460,sackOK,timestamp 4152861140 0,nop,wscale 7> (DF) [tos 0x68]
10:34:58.879222  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: S 1017497190:1017497190(0) ack 1093512124 win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 6,nop,nop,timestamp 4107297338 4152861140> (DF)
10:34:58.902942 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: . ack 1 win 229 <nop,nop,timestamp 4152861164 4107297338> (DF) [tos 0x68]
10:34:58.902980 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: P 1:24(23) ack 1 win 229 <nop,nop,timestamp 4152861164 4107297338> (DF) [tos 0x68]
10:34:58.916629  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: P 1:22(21) ack 24 win 271 <nop,nop,timestamp 4107297338 4152861164> (DF)
10:34:58.939061 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: . ack 22 win 229 <nop,nop,timestamp 4152861201 4107297338> (DF) [tos 0x68]
10:34:58.939120  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: P 22:1054(1032) ack 24 win 271 <nop,nop,timestamp 4107297338 4152861201> (DF)
10:34:58.939603 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: P 24:672(648) ack 22 win 229 <nop,nop,timestamp 4152861201 4107297338> (DF) [tos 0x68]
10:34:58.941607  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: F 1054:1054(0) ack 672 win 271 <nop,nop,timestamp 4107297338 4152861201> (DF)
10:34:58.961672 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: F 672:672(0) ack 1054 win 245 <nop,nop,timestamp 4152861223 4107297338> (DF) [tos 0x68]
10:34:58.961721  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: F 1054:1054(0) ack 673 win 271 <nop,nop,timestamp 4107297338 4152861223> (DF)
10:34:58.963932 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: . ack 1055 win 245 <nop,nop,timestamp 4152861226 4107297338> (DF) [tos 0x68]

What I am afraid of is the flags S, P and F which means Sync, Push, Finish...

I am not good in networking, but can I considered that connection compromised my server? Are there full traffic between that IP and my server or is it just a connection try?

Answer 1

Syn, Push, Fin are normal flags of TCP packets. By themselves, they don't say anything about whether your server is compromised or not.

• Syn means wanting to start a new connection
• Push means wanting to send data on the connection
• Fin means wanting to close the connection

Looking at the traffic, my guess that it failed even before trying to authenticate to the server:

10:34:58.879055 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: S 1093512123:1093512123(0) win 29200 <mss 1460,sackOK,timestamp 4152861140 0,nop,wscale 7> (DF) [tos 0x68]
10:34:58.879222  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: S 1017497190:1017497190(0) ack 1093512124 win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 6,nop,nop,timestamp 4107297338 4152861140> (DF)
10:34:58.902942 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: . ack 1 win 229 <nop,nop,timestamp 4152861164 4107297338> (DF) [tos 0x68]

This is the 3-way TCP handshake, initiated by XX.XX.XX.XX wanting to connect to YY.YY.YY.YY. The Syn flag indicate that this is the start of a new connection.

10:34:58.902980 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: P 1:24(23) ack 1 win 229 <nop,nop,timestamp 4152861164 4107297338> (DF) [tos 0x68]
10:34:58.916629  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: P 1:22(21) ack 24 win 271 <nop,nop,timestamp 4107297338 4152861164> (DF)
10:34:58.939061 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: . ack 22 win 229 <nop,nop,timestamp 4152861201 4107297338> (DF) [tos 0x68]

In the start of each SSH connection, each side sends a "banner" which is a short text that says what kind of SSH software it uses. These packets look like XX.XX.XX.XX sends its banner to YY.YY.YY.YY; then YY.YY.YY.YY acknowledges it and sends its banner to XX.XX.XX.XX; then XX.XX.XX.XX acknowledges it.

10:34:58.939120  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: P 22:1054(1032) ack 24 win 271 <nop,nop,timestamp 4107297338 4152861201> (DF)
10:34:58.939603 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: P 24:672(648) ack 22 win 229 <nop,nop,timestamp 4152861201 4107297338> (DF) [tos 0x68]

According to the SSH protocol, after sending the banner, each side sends a message indicating which encryption algorithms it supports, which key exchange protocols it supports, etc, in order for both sides to negotiate an encryption key to be used when making the connection encrypted.

10:34:58.941607  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: F 1054:1054(0) ack 672 win 271 <nop,nop,timestamp 4107297338 4152861201> (DF)
10:34:58.961672 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: F 672:672(0) ack 1054 win 245 <nop,nop,timestamp 4152861223 4107297338> (DF) [tos 0x68]
10:34:58.961721  YY.YY.YY.YY.5022 > XX.XX.XX.XX.59800: F 1054:1054(0) ack 673 win 271 <nop,nop,timestamp 4107297338 4152861223> (DF)
10:34:58.963932 XX.XX.XX.XX.59800 >  YY.YY.YY.YY.5022: . ack 1055 win 245 <nop,nop,timestamp 4152861226 4107297338> (DF) [tos 0x68]

Apparently YY.YY.YY.YY didn't like what XX.XX.XX.XX sent (maybe there is no algorithm they both support? or XX.XX.XX.XX sent a malformed packet?), so instead of continuing to key exchange it decided to tell XX.XX.XX.XX (by using the Fin flag) that it wants to close the connection instead of continuing it further. XX.XX.XX.XX also uses the Fin flag to close the connection (either because it also determined that key exchange is not possible, or because it got YY.YY.YY.YY's Fin).

Theoretically the person who uses XX.XX.XX.XX could fix XX.XX.XX.XX to support more algorithms in order to successfully complete the key-exchange and try to brute-force the login.