Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suspicious Traffic?

    Scheduled Pinned Locked Moved General pfSense Questions
    54 Posts 4 Posters 18.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      deanfourie
      last edited by stephenw10 

      WAN	tcp	192.168.8.2:12812 (172.16.101.17:50569) -> 20.198.119.84:443	ESTABLISHED:ESTABLISHED	270 / 150	25 KiB / 34 KiB	
WAN	tcp	192.168.8.2:18400 (172.16.101.17:50585) -> 74.125.68.188:5228	ESTABLISHED:ESTABLISHED	163 / 166	7 KiB / 18 KiB	
WAN	tcp	192.168.8.2:46821 (172.16.101.7:40860) -> 34.120.177.193:443	ESTABLISHED:ESTABLISHED	19 / 18	2 KiB / 5 KiB	
WAN	tcp	192.168.8.2:2211 (172.16.101.7:52014) -> 185.199.108.133:443	ESTABLISHED:ESTABLISHED	11 / 11	1 KiB / 5 KiB	
WAN	tcp	192.168.8.2:47425 (172.16.101.15:49690) -> 76.223.31.44:443	ESTABLISHED:ESTABLISHED	40 / 42	2 KiB / 17 KiB	
WAN	tcp	192.168.8.2:20743 (172.16.101.15:49408) -> 20.198.119.143:443	ESTABLISHED:ESTABLISHED	49 / 33	6 KiB / 9 KiB	
WAN	tcp	192.168.8.2:7210 (172.16.101.15:49738) -> 185.159.80.151:8886	ESTABLISHED:ESTABLISHED	317 / 449	13 KiB / 18 KiB	
WAN	tcp	192.168.8.2:11825 (172.16.101.15:49775) -> 74.125.200.188:5228	ESTABLISHED:ESTABLISHED	102 / 102	5 KiB / 12 KiB	
WAN	tcp	192.168.8.2:50350 (172.16.101.15:1025) -> 162.159.130.234:443	ESTABLISHED:ESTABLISHED	2.854 K / 3.08 K	128 KiB / 685 KiB	
WAN	udp	192.168.8.2:5477 -> 173.234.106.107:1194	MULTIPLE:MULTIPLE	4.046 K / 4.045 K	333 KiB / 327 KiB	
WAN	icmp	192.168.8.2:53676 -> 1.1.1.1:53676	0:0	4.023 K / 4.022 K	114 KiB / 114 KiB	
WAN	tcp	192.168.8.2:39097 (172.16.101.15:1503) -> 208.123.73.199:443	ESTABLISHED:ESTABLISHED	1.788 K / 1.927 K	479 KiB / 429 KiB	
WAN	tcp	192.168.8.2:57584 (172.16.101.15:12915) -> 151.101.165.2:443	ESTABLISHED:ESTABLISHED	1.074 K / 1.735 K	168 KiB / 1.86 MiB	
WAN	tcp	192.168.8.2:29269 (172.16.101.15:12923) -> 54.235.148.246:443	ESTABLISHED:ESTABLISHED	59 / 58	4 KiB / 14 KiB	
WAN	tcp	192.168.8.2:43248 (172.16.101.7:52032) -> 185.199.108.133:443	ESTABLISHED:ESTABLISHED	14 / 13	1 KiB / 5 KiB	
WAN	tcp	192.168.8.2:29264 (172.16.101.7:40878) -> 34.120.177.193:443	ESTABLISHED:ESTABLISHED	20 / 18	2 KiB / 5 KiB	
WAN	tcp	192.168.8.2:63243 (172.16.101.17:50822) -> 35.82.210.186:443	ESTABLISHED:FIN_WAIT_2	11 / 14	1 KiB / 8 KiB	
WAN	tcp	192.168.8.2:42063 (172.16.101.15:1083) -> 151.101.194.137:443	FIN_WAIT_2:FIN_WAIT_2	257 / 449	41 KiB / 533 KiB	
WAN	tcp	192.168.8.2:21220 (172.16.101.15:1087) -> 199.232.214.133:443	FIN_WAIT_2:FIN_WAIT_2	2.131 K / 3.173 K	146 KiB / 3.03 MiB	
WAN	tcp	192.168.8.2:25604 (172.16.101.15:1091) -> 151.101.130.137:443	FIN_WAIT_2:FIN_WAIT_2	309 / 499	31 KiB / 418 KiB	
WAN	tcp	192.168.8.2:7591 (172.16.101.7:40880) -> 34.120.177.193:443	ESTABLISHED:CLOSING	19 / 29	2 KiB / 7 KiB	
WAN	tcp	192.168.8.2:24193 (172.16.101.7:38508) -> 185.199.110.133:443	ESTABLISHED:ESTABLISHED	12 / 12	1 KiB / 5 KiB	
WAN	tcp	192.168.8.2:41881 (172.16.101.15:1318) -> 142.250.71.78:443	ESTABLISHED:ESTABLISHED	33 / 40	10 KiB / 10 KiB	
WAN	tcp	192.168.8.2:55573 (172.16.101.15:1352) -> 3.24.51.182:21	ESTABLISHED:ESTABLISHED	50 / 51	4 KiB / 6 KiB	
WAN	tcp	192.168.8.2:25728 (172.16.101.15:1378) -> 162.159.135.232:443	FIN_WAIT_2:FIN_WAIT_2	14 / 13	1 KiB / 6 KiB	
WAN	tcp	192.168.8.2:8063 (172.16.101.15:1410) -> 44.226.92.23:443	TIME_WAIT:TIME_WAIT	12 / 12	2 KiB / 8 KiB	
WAN	udp	192.168.8.2:9834 (172.16.101.15:65210) -> 142.250.67.10:443	MULTIPLE:MULTIPLE	21 / 24	5 KiB / 7 KiB	
WAN	tcp	192.168.8.2:55434 (172.16.101.17:50851) -> 52.41.50.6:443	FIN_WAIT_2:FIN_WAIT_2	11 / 12	2 KiB / 6 KiB	
WAN	tcp	192.168.8.2:57382 (172.16.101.15:1418) -> 35.82.210.186:443	TIME_WAIT:TIME_WAIT	12 / 11	2 KiB / 6 KiB	
WAN	tcp	192.168.8.2:54394 (172.16.101.15:1419) -> 202.124.124.90:80	FIN_WAIT_2:FIN_WAIT_2	6 / 5	346 B / 391 B	
WAN	tcp	192.168.8.2:22280 (172.16.101.15:1420) -> 44.226.92.23:443	FIN_WAIT_2:FIN_WAIT_2	14 / 11	3 KiB / 6 KiB	
WAN	tcp	192.168.8.2:44695 (172.16.101.15:1421) -> 35.82.210.186:443	TIME_WAIT:TIME_WAIT	12 / 12	2 KiB / 8 KiB	
WAN	tcp	192.168.8.2:1247 (172.16.101.15:1422) -> 35.82.210.186:443	FIN_WAIT_2:FIN_WAIT_2	12 / 12	2 KiB / 6 KiB	
WAN	tcp	192.168.8.2:17221 (172.16.101.15:1423) -> 202.124.124.91:80	FIN_WAIT_2:FIN_WAIT_2	6 / 5	346 B / 391 B	
WAN	udp	192.168.8.2:19584 (172.16.101.15:53957) -> 142.250.204.4:443	MULTIPLE:MULTIPLE	175 / 396	26 KiB / 376 KiB	
WAN	tcp	192.168.8.2:47504 (172.16.101.17:50852) -> 44.226.92.23:443	FIN_WAIT_2:FIN_WAIT_2	11 / 12	2 KiB / 6 KiB	
WAN	tcp	192.168.8.2:48004 (172.16.101.15:1426) -> 202.124.124.91:80	FIN_WAIT_2:FIN_WAIT_2	4 / 5	266 B / 391 B	
WAN	udp	192.168.8.2:23977 (172.16.101.15:62766) -> 142.250.67.14:443	MULTIPLE:MULTIPLE	40 / 55	6 KiB / 44 KiB	
WAN	udp	192.168.8.2:29747 (172.16.101.15:52600) -> 172.217.24.42:443	MULTIPLE:MULTIPLE	12 / 11	4 KiB / 7 KiB	
WAN	tcp	192.168.8.2:12425 (172.16.101.15:1427) -> 172.217.24.42:443	FIN_WAIT_2:FIN_WAIT_2	10 / 10	1 KiB / 6 KiB	
WAN	udp	192.168.8.2:35646 (172.16.101.15:64854) -> 172.217.167.110:443	MULTIPLE:MULTIPLE	18 / 21	6 KiB / 6 KiB	
WAN	udp	192.168.8.2:17732 (172.16.101.15:52777) -> 142.251.12.100:443	MULTIPLE:MULTIPLE	8 / 7	2 KiB / 3 KiB	
WAN	udp	192.168.8.2:25021 (172.16.101.17:61533) -> 172.217.167.110:443	MULTIPLE:MULTIPLE	10 / 11	3 KiB / 5 KiB	
WAN	udp	192.168.8.2:42623 (172.16.101.15:64825) -> 142.250.71.74:443	MULTIPLE:MULTIPLE	9 / 9	3 KiB / 4 KiB	
WAN	udp	192.168.8.2:14418 (172.16.101.15:58123) -> 142.250.66.238:443	MULTIPLE:MULTIPLE	9 / 10	4 KiB / 5 KiB	
WAN	udp	192.168.8.2:45098 (172.16.101.15:62002) -> 151.101.165.229:443	MULTIPLE:MULTIPLE	7 / 5	2 KiB / 4 KiB	
WAN	tcp	192.168.8.2:18827 (172.16.101.15:1430) -> 68.67.73.20:443	TIME_WAIT:TIME_WAIT	9 / 10	1015 B / 6 KiB	
WAN	tcp	192.168.8.2:11080 (172.16.101.15:1431) -> 68.67.73.20:443	TIME_WAIT:TIME_WAIT	23 / 27	6 KiB / 27 KiB	
WAN	tcp	192.168.8.2:5459 (172.16.101.15:1432) -> 68.67.73.20:443	TIME_WAIT:TIME_WAIT	10 / 10	1 KiB / 6 KiB	
WAN	tcp	192.168.8.2:2903 -> 204.61.216.50:53	FIN_WAIT_2:FIN_WAIT_2	6 / 5	366 B / 2 KiB	
WAN	tcp	192.168.8.2:28352 (172.16.101.15:1437) -> 44.226.92.23:443	TIME_WAIT:TIME_WAIT	11 / 11	2 KiB / 6 KiB	
WAN	tcp	192.168.8.2:4299 (172.16.101.15:1438) -> 202.124.124.90:80	FIN_WAIT_2:FIN_WAIT_2	5 / 5	306 B / 391 B	
WAN	tcp	192.168.8.2:43484 (172.16.101.15:1439) -> 208.123.73.73:443	TIME_WAIT:TIME_WAIT	21 / 35	5 KiB / 40 KiB	
WAN	tcp	192.168.8.2:51773 (172.16.101.15:1440) -> 208.123.73.73:443	TIME_WAIT:TIME_WAIT	14 / 15	4 KiB / 12 KiB	
WAN	tcp	192.168.8.2:1628 (172.16.101.15:1441) -> 208.123.73.73:443	ESTABLISHED:ESTABLISHED	5 / 4	809 B / 511 B	
WAN	tcp	192.168.8.2:38092 (172.16.101.15:1442) -> 208.123.73.73:443	ESTABLISHED:ESTABLISHED	9 / 9	993 B / 7 KiB	
WAN	tcp	192.168.8.2:24666 (172.16.101.15:1443) -> 208.123.73.73:443	ESTABLISHED:ESTABLISHED	5 / 4	809 B / 511 B	
WAN	tcp	192.168.8.2:8877 (172.16.101.15:1444) -> 208.123.73.73:443	ESTABLISHED:ESTABLISHED	9 / 9	993 B / 7 KiB	
WAN	tcp	192.168.8.2:49217 (172.16.101.15:1445) -> 208.123.73.73:443	ESTABLISHED:ESTABLISHED	8 / 9	941 B / 7 KiB	
WAN	tcp	192.168.8.2:20808 (172.16.101.15:1446) -> 35.82.210.186:443	FIN_WAIT_2:FIN_WAIT_2	12 / 11	3 KiB / 6 KiB	
WAN	tcp	192.168.8.2:10716 -> 199.180.180.63:53	TIME_WAIT:TIME_WAIT	5 / 5	327 B / 2 KiB	
WAN	tcp	192.168.8.2:27420 (172.16.101.15:1447) -> 44.226.92.23:443	ESTABLISHED:ESTABLISHED	12 / 12	2 KiB / 8 KiB	
WAN	tcp	192.168.8.2:31279 (172.16.101.15:1448) -> 44.226.92.23:443	FIN_WAIT_2:FIN_WAIT_2	12 / 12	2 KiB / 6 KiB	
WAN	tcp	192.168.8.2:65211 (172.16.101.17:50853) -> 35.82.210.186:443	FIN_WAIT_2:FIN_WAIT_2	11 / 12	2 KiB / 6 KiB	
WAN	udp	192.168.8.2:60136 -> 150.171.16.34:53	MULTIPLE:SINGLE	1 / 1	73 B / 89 B	
WAN	udp	192.168.8.2:34690 -> 202.124.124.84:53	MULTIPLE:SINGLE	1 / 1	76 B / 108 B	
WAN	tcp	192.168.8.2:62217 (172.16.101.15:1449) -> 202.124.124.91:80	FIN_WAIT_2:FIN_WAIT_2	5 / 5	306 B / 391 B	
WAN	tcp	192.168.8.2:43879 (172.16.101.15:1450) -> 202.124.124.91:80	FIN_WAIT_2:FIN_WAIT_2	6 / 5	346 B / 391 B	
WAN	udp	192.168.8.2:23297 (172.16.101.15:50903) -> 142.250.204.4:443	MULTIPLE:MULTIPLE	5 / 5	3 KiB / 3 KiB	
WAN	udp	192.168.8.2:5215 (172.16.101.5:123) -> 103.242.68.69:123	MULTIPLE:SINGLE	1 / 1	76 B / 76 B	
WAN	udp	192.168.8.2:7924 (172.16.101.5:123) -> 162.159.200.1:123	MULTIPLE:SINGLE	1 / 1	76 B / 76 B	
WAN	udp	192.168.8.2:20410 (172.16.101.5:123) -> 163.47.220.60:123	MULTIPLE:SINGLE	1 / 1	76 B / 76 B	
WAN	tcp	192.168.8.2:19162 (172.16.101.15:1451) -> 52.41.50.6:443	ESTABLISHED:ESTABLISHED	11 / 11	2 KiB / 6 KiB	
WAN	tcp	192.168.8.2:48761 (172.16.101.17:50854) -> 44.226.92.23:443	ESTABLISHED:ESTABLISHED	10 / 11	2 KiB / 6 KiB
      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @deanfourie
        last edited by

        @deanfourie I don't see any states to that 8. address.

        So pfsense didn't create, nor did a client create a connection to there.. Do a simple filter on your state table for the IPs in question.

        If you do not see any states then pfsense did not create the connection, nor did a client behind pfsense.

        And what you could be seeing could be SA scan, that is being interpreted wrong???

        But if your concerned that pfsense, or something behind pfsense is creating connections to somewhere it shouldn't be - look in the state table.. If a connection attempt was made from or through pfsense then a state would exist. Even if the connection was not established.

        Here - trying to ping one of those IPs.. Even though not getting an answer, you can see the state in the state table from pfsense

        ping.jpg

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        D 1 Reply Last reply Reply Quote 0
        • D
          deanfourie @johnpoz
          last edited by deanfourie

          @johnpoz Ok great ill do this.

          I hate working with upstream gateways and double natting, would much rather put the router in bridged mode and get WAN IP from DHCP and boom! Last time I did this I was on the naughty list with the ISP. They warned me

          I will do more careful watching of the state table. My concern is actually with the 4G router still though,

          If its doing some sort of dodgy proxying at the 4G router, I'm not going to be able to see that from pfSense WAN side as its before the WAN interface.

          I mean at the end of the day, it is a Huawei router...

          I cant even disable TR-069 on it, nor can I change the LAN subnet mask.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            If you're concerned about it the only thing you can really do is tunnel all your traffic through it so the router never sees inside it. There is obviously overhead to doing that though.

            Steve

            D 1 Reply Last reply Reply Quote 0
            • D
              deanfourie @stephenw10
              last edited by

              @stephenw10 I originally was routing all traffic through a VPN, however I got so many more weird connections as a result.

              One question I do have is, would doubling NATting effect the results of the flows in ntopng.

              Like matching ports and applications etc?

              Thanks

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                No I wouldn't expect it to. The source/destination ports/IPs that ntop can see are still the same.

                D 1 Reply Last reply Reply Quote 0
                • D
                  deanfourie @stephenw10
                  last edited by

                  @stephenw10 said in Suspicious Traffic?:

                  No I wouldn't expect it to. The source/destination ports/IPs that ntop can see are still the same.

                  Thank you

                  1 Reply Last reply Reply Quote 0
                  • D
                    deanfourie
                    last edited by deanfourie

                    Maybe someone could take a look at this capture. Lots of SSH from 192.168.8.2 which is my pfSense firewall.

                    Also a lot of TCP retransmissions. I'm not sure how my pfSense could be sending out SSH traffic?

                    capture.pcap

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @deanfourie
                      last edited by johnpoz

                      @deanfourie pfsense out of the box would not be doing any ssh outbound..

                      You would see retrans when you send a syn and you don't get an answer..

                      Did you look in your state table for those IPs to what behind pfsense might be trying to talk to those IPs.. Looks like Ips on your ISP network.

                      ;; ANSWER SECTION:
22.239.24.86.in-addr.arpa. 86400 IN     PTR     cpc152131-stkp13-2-0-cust21.10-2.cable.virginm.net.

                      Dude do you have Ntopng running in discovery mode on your wan?? That would for sure freaking do it..

                      ntop.jpg

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      D 1 Reply Last reply Reply Quote 0
                      • D
                        deanfourie @johnpoz
                        last edited by

                        @johnpoz Heres what I found in the states table.

                        Capture.PNG

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @deanfourie
                          last edited by

                          @deanfourie Dude stop having ntop try to discovery your wan.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          D 1 Reply Last reply Reply Quote 0
                          • D
                            deanfourie @johnpoz
                            last edited by

                            @johnpoz oh that's not ntop that's the states table.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @deanfourie
                              last edited by johnpoz

                              @deanfourie Again the only thing that would do what your seeing is ntop in discovery mode.. Turn it off and that traffic will stop..

                              Its not suspicious traffic - its ntop in discovery mode..

                              Why you would have it trying to discover your wan what is causing that traffic.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              D 1 Reply Last reply Reply Quote 0
                              • D
                                deanfourie @johnpoz
                                last edited by

                                @johnpoz so you're telling me that ntop is creating these outbound ssh connections?

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @deanfourie
                                  last edited by johnpoz

                                  @deanfourie Yes - its discovery mode.. Is looking for stuff.. ssh (port 22) being one of the things it looks for.

                                  Here is a recent thread - same sort of thing

                                  https://forum.netgate.com/topic/172680/ntopng-sshguard

                                  Here is the code from the ntop

                                  https://github.com/ntop/ntopng/blob/dev/scripts/lua/modules/discover_utils.lua#L495

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  D 1 Reply Last reply Reply Quote 0
                                  • D
                                    deanfourie @johnpoz
                                    last edited by

                                    @johnpoz but would it not see this traffic only if this traffic existed? Hence why it's seeing it

                                    I don't know what am I missing?

                                    johnpozJ D 2 Replies Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @deanfourie
                                      last edited by johnpoz

                                      @deanfourie its creating it!! Turn off discovery!

                                      discovery.jpg

                                      Ntop is creating the traffic - so yes you see it

                                      Or uncheck ntop from using your wan.. There is little reason for ntop on your wan. You wan to see where your clients are going - not all the noise hitting your wan.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        deanfourie @deanfourie
                                        last edited by

                                        @deanfourie dude, my WAN is a upstream gateway, is is simply another private network as far as ntop is concerned.

                                        The fact is I'm seeing SSH traffic from my pfSense WAN interface, and seeing the connections in the pfSense states table.

                                        How's that normal?

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Because ntop is sending them to try to detect hosts on that subnet. That's what the active discovery does.

                                          D 1 Reply Last reply Reply Quote 1
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @deanfourie
                                            last edited by

                                            @deanfourie I have no idea what else to tell you - ntop is creating that traffic, its not suspicious.

                                            If you don't want it doing it, then turn it off from doing it, if you want your ntop discovery your isp network - have at it, they might not be happy about that, or your isp other users, etc..

                                            Why don't you turn off the auto discovery I showed you - do you continue to see this traffic?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.