Suspicious Traffic?
-
@stephenw10 said in Suspicious Traffic?:
No I wouldn't expect it to. The source/destination ports/IPs that ntop can see are still the same.
Thank you
-
Maybe someone could take a look at this capture. Lots of SSH from 192.168.8.2 which is my pfSense firewall.
Also a lot of TCP retransmissions. I'm not sure how my pfSense could be sending out SSH traffic?
-
@deanfourie pfsense out of the box would not be doing any ssh outbound..
You would see retrans when you send a syn and you don't get an answer..
Did you look in your state table for those IPs to what behind pfsense might be trying to talk to those IPs.. Looks like Ips on your ISP network.
;; ANSWER SECTION: 22.239.24.86.in-addr.arpa. 86400 IN PTR cpc152131-stkp13-2-0-cust21.10-2.cable.virginm.net.Dude do you have Ntopng running in discovery mode on your wan?? That would for sure freaking do it..
-
@johnpoz Heres what I found in the states table.
-
@deanfourie Dude stop having ntop try to discovery your wan.
-
@johnpoz oh that's not ntop that's the states table.
-
@deanfourie Again the only thing that would do what your seeing is ntop in discovery mode.. Turn it off and that traffic will stop..
Its not suspicious traffic - its ntop in discovery mode..
Why you would have it trying to discover your wan what is causing that traffic.
-
@johnpoz so you're telling me that ntop is creating these outbound ssh connections?
-
@deanfourie Yes - its discovery mode.. Is looking for stuff.. ssh (port 22) being one of the things it looks for.
Here is a recent thread - same sort of thing
https://forum.netgate.com/topic/172680/ntopng-sshguard
Here is the code from the ntop
https://github.com/ntop/ntopng/blob/dev/scripts/lua/modules/discover_utils.lua#L495
-
@johnpoz but would it not see this traffic only if this traffic existed? Hence why it's seeing it
I don't know what am I missing?
-
@deanfourie its creating it!! Turn off discovery!
Ntop is creating the traffic - so yes you see it
Or uncheck ntop from using your wan.. There is little reason for ntop on your wan. You wan to see where your clients are going - not all the noise hitting your wan.
-
@deanfourie dude, my WAN is a upstream gateway, is is simply another private network as far as ntop is concerned.
The fact is I'm seeing SSH traffic from my pfSense WAN interface, and seeing the connections in the pfSense states table.
How's that normal?
-
Because ntop is sending them to try to detect hosts on that subnet. That's what the active discovery does.
-
@deanfourie I have no idea what else to tell you - ntop is creating that traffic, its not suspicious.
If you don't want it doing it, then turn it off from doing it, if you want your ntop discovery your isp network - have at it, they might not be happy about that, or your isp other users, etc..
Why don't you turn off the auto discovery I showed you - do you continue to see this traffic?
-
@stephenw10 but the connection is to a external IP?
-
@deanfourie said in Suspicious Traffic?:
but the connection is to a external IP?
What are you not understanding that network is trying to be discovered by ntop - its your actual ISP network.. Doesn't matter if your behind a double nat or not.
Again turn off the auto discovery - does that traffic go away?
pfsense out of the box would not be creating random connections to IPs out on the internet. But you know what would - ntop discovery.. You are running ntop, I showed you from sniff clearly showing ntop doing discovery - see the user agent in what I posted..
So either let it do what its doing, or disable auto discovery, or configure ntop not to use your wan interface on pfsense for discovery.
-
@johnpoz ok, ive turned of network discovery (active network discovery) and it has not gone away. Still there are multiple SSH sessions to a random WAN IP
-
@deanfourie said in Suspicious Traffic?:
Still there are multiple SSH sessions to a random WAN IP
Your still seeing them being created, or they are old ones in your state table..
Here is the thing there is NOTHING in pfsense that would do that - NOTHING.. So its ntop doing it, or you have some other package installed doing it. Pfsense does not just randomly create outbound connections on 22 to IPs on your isp network. It doesn't - Period!
You looked in your state table, so its not some client behind pfsense doing it, or you would see the client ip in the state table that is trying to do it..
edit: Also I don't think turning it off instantly stops and current discovery that is running.. If you have it on there would be discovery time, defaults to every 15 minutes I believe.
Turn off ntop completely - do you still see new connections being made?
If you wan to see what is making the connections from pfsense, do a sockstat, here in a session on pfsense I created a ssh connection to one of my box on my network. Then viewing sockstat I can see that connection being made with ssh program.. If your still see them after you have stopped ntop and kill all existing states..
-
@johnpoz ok ill go through and disable all my packages one by one
-
@deanfourie see my edit in finding what is creating the connections using sockstat
But I would bet a very large sum of money its ntop.. A very large sum!
