Single incoming port is over 50% of the blocked traffic

[ando1]

I recently started using an ELK stack to monitor my pfsense firewall. Today I was looking at the dashboard and noticed the incoming blocks over time graph. One port (TCP 30303) makes up over 60% of all the blocked ports. Curious, I immediately did a search on this port and found that is is associated with an old (1990's) trojan virus. "That's good" I thought to myself. "I am glad that my firewall is blocking that." Even more curious I searched on this trojan called "Sockets de Troie" and all I can find on it dates way back to 2005 and older. While I am glad that my firewall is blocking this, I am really curious as to why this port makes up over half of the blocks on my firewall. I am asking the community here if anyone has seen this port blocked on their firewall and if it makes up a large percentage of the blocks?

Thanks,
Andy

[Stewart]

What IP is being blocked?  Could it be a coincidence that it may be something else using the same port?

[ando1]

Stewart,

There are multiple IP address ranging from the US, CZ, NL, etc.  See below screenshots.

[johnpoz]

Not seeing any hits on that port from anywhere.

Sure that just not a port you "were" using for p2p or something.  Did your IP recently change?  Could of gotten an IP in an old swarm there was the port they were using.

What time frame is that over?  Its not a large number of hits, unless your talking only a few seconds?  I have 239 some hits on just 23 (telnet) in the last 7 hours..

Its easy to get curious about these odd ball ports, there might be something out on 30303 kind of like the previous modem thing on port 7547

You sure its TCP and not a mix.. you have a lot of high port listed that seem a bit strange.. Are they blocked as SYN, or is it out of state traffic?  I change my log to only log tcp that are syn hits.. vs logging the odd udp port and out of state packets that just clutter up the log..

[ando1]

@Johnpoz

I don't do any P2P on my network so I dont think it is that. They only other thing I found about the port is it is apparently used by an app called Etherum that appears to be somewhat like Bitcoin: https://www.ethereum.org/

I also don't think my WAN IP has changed in a while the timeframe for those hits was about 2 weeks.

EDIT: Also I did a drill down into the protocols and port 30303 is a mix of TCP and UDP:

[johnpoz]

you sure some of those are not out of state hits?  The udp is all just noise.. I really see no pint in logging it to be honest..

If those are SYN hits, then yes its directed traffic.  If its out of state its possible it just left over packets from after you closed a session, etc… your 23, 22, 1433 are real common you will see lots of those.  Bots searching the net for open shit hey can try and exploit.  The high ports could be just junk.

It is curious that your seeing a few ports make up large % of it though.. I checked my logs I have not seen any hits to 30303 tcp at all..

Again what is the time frame in these graphs, last 24 hours?  Last hour? etc..  If your curious do a packet capture on your wan on that port and might give you some insight to what it is.  For sure will tell you if syn or just out of state ack.  If ack, take a look at your state table do you see any traffic going somewhere with that 30303 as source port?

[pfBasic]

I'm using pfmonitor and did a search for 30303.

Nothing on my firewall, but it's #108 on the global list (94 firewalls as of this posting) at 13732 total hits coming from 579 unique IP's.

Historicals show a massive spike in hits on 18 May, with hardly any prior to that (firewall(s) being hit on this port may have been added on that day?)

Here's the list of source IP's coming up on pfmonitor top 250.

Source IP:                 Most Recent Hit Date/Time:	Attack Hit Count:
46.238.139.199	 	 	05-18-2017 20:36:49	549
86.18.189.216	 	 	05-18-2017 16:56:27	384
85.150.127.156	 	 	05-18-2017 12:03:21	345
62.12.24.76	 	 	05-19-2017 03:09:23	312
91.40.202.170	 	 	05-19-2017 01:47:23	276
72.224.253.46	 	 	05-18-2017 18:07:46	265
105.212.54.158	 	 	05-19-2017 15:21:20	259
178.238.233.123	 	 	05-21-2017 23:58:49	255
142.58.181.70	 	 	05-22-2017 07:59:56	193
84.215.11.115	 	 	05-20-2017 04:33:17	184
148.251.191.101	 	 	05-21-2017 04:32:08	164
137.101.116.132	 	 	05-21-2017 16:38:44	138
176.21.123.95	 	 	05-22-2017 12:25:46	136
104.219.251.104	 	 	05-22-2017 13:31:48	106
188.138.1.237	 	 	05-19-2017 03:11:28	100
138.197.210.35	 	 	05-18-2017 18:39:31	100
216.162.77.54	 	 	05-19-2017 02:19:02	96
69.110.136.53	 	 	05-21-2017 00:28:12	92
132.67.114.248	 	 	05-19-2017 02:14:40	90
104.196.185.70	 	 	05-22-2017 00:00:47	86
147.30.171.14	 	 	05-19-2017 00:16:33	85
188.2.163.78	 	 	05-18-2017 15:53:39	83
89.76.252.94	 	 	05-19-2017 01:22:13	80
98.212.81.225	 	 	05-18-2017 20:36:17	75
174.6.150.210	 	 	05-19-2017 12:16:49	71
34.202.6.206	 	 	05-18-2017 11:18:29	63
83.163.134.101	 	 	05-18-2017 14:10:34	62
62.109.14.140	 	 	05-19-2017 00:09:35	58
182.142.145.44	 	 	05-19-2017 22:10:19	56
66.147.230.39	 	 	05-19-2017 00:45:32	56
124.62.23.142	 	 	05-18-2017 18:48:00	56
195.211.136.9	 	 	05-20-2017 00:54:29	53
138.197.138.202	 	 	05-19-2017 00:30:12	53
46.48.61.124	 	 	05-18-2017 22:17:05	52
46.101.204.158	 	 	05-18-2017 19:30:44	52
185.61.38.40	 	 	05-21-2017 01:20:36	51
139.162.120.161	 	 	05-19-2017 02:50:36	51
168.181.187.15	 	 	05-22-2017 10:59:13	50
81.169.228.109	 	 	05-19-2017 02:02:03	49
97.113.232.235	 	 	05-19-2017 07:56:03	48
1.226.84.230	 	 	05-19-2017 04:19:44	48
178.236.134.19	 	 	05-22-2017 12:06:17	47
83.81.146.16	 	 	05-18-2017 18:02:01	46
108.36.116.9	 	 	05-19-2017 02:17:45	45
47.90.36.129	 	 	05-19-2017 02:27:20	44
5.22.157.49	 	 	05-19-2017 01:34:29	44
47.201.37.192	 	 	05-18-2017 18:21:32	44
198.23.230.254	 	 	05-19-2017 05:29:44	42
45.55.38.145	 	 	05-18-2017 19:39:06	41
5.255.90.216	 	 	05-19-2017 02:55:16	40
52.3.44.101	 	 	05-19-2017 02:52:40	40
70.122.214.59	 	 	05-19-2017 02:46:34	40
93.190.142.88	 	 	05-19-2017 01:52:39	40
47.89.55.68	 	 	05-19-2017 01:46:35	40
88.99.214.58	 	 	05-19-2017 01:41:06	40
204.14.245.175	 	 	05-19-2017 00:13:08	40
88.99.65.139	 	 	05-18-2017 22:59:38	40
35.163.247.198	 	 	05-18-2017 19:30:40	40
77.173.25.90	 	 	05-18-2017 18:59:45	40
163.172.4.66	 	 	05-18-2017 18:11:10	40
45.55.21.224	 	 	05-19-2017 02:48:29	38
24.35.73.25	 	 	05-19-2017 03:30:33	36
163.172.77.155	 	 	05-19-2017 02:41:05	36
52.205.143.107	 	 	05-19-2017 02:02:29	36
188.166.164.132	 	 	05-19-2017 01:28:43	36
139.224.209.162	 	 	05-19-2017 01:03:44	36
192.241.159.215	 	 	05-19-2017 00:55:01	36
83.143.36.227	 	 	05-18-2017 22:59:26	36
51.255.168.98	 	 	05-19-2017 00:14:30	35
85.143.206.232	 	 	05-19-2017 03:44:06	33
221.222.125.181	 	 	05-18-2017 19:46:43	33
176.10.137.87	 	 	05-18-2017 19:24:14	33
45.63.76.145	 	 	05-19-2017 03:15:53	32
81.7.16.17	 	 	05-19-2017 02:33:48	32
45.122.221.11	 	 	05-19-2017 02:26:19	32
163.172.162.229	 	 	05-19-2017 02:24:53	32
13.124.50.140	 	 	05-19-2017 02:07:42	32
139.162.15.124	 	 	05-19-2017 01:46:39	32
46.166.165.130	 	 	05-19-2017 01:24:18	32
207.154.222.65	 	 	05-19-2017 01:22:15	32
115.159.50.247	 	 	05-18-2017 23:52:39	32
71.90.103.184	 	 	05-18-2017 23:49:07	32
139.59.109.100	 	 	05-18-2017 23:45:09	32
87.81.185.130	 	 	05-18-2017 22:31:21	32
24.228.2.129	 	 	05-18-2017 19:58:05	32
52.230.20.20	 	 	05-18-2017 19:21:59	32
2.217.219.175	 	 	05-18-2017 19:09:13	32
67.166.72.238	 	 	05-18-2017 18:52:13	32
52.196.42.124	 	 	05-18-2017 16:56:27	32
35.2.92.74	 	 	05-18-2017 13:55:28	32
213.140.215.229	 	 	05-18-2017 13:46:56	32
185.82.202.93	 	 	05-19-2017 10:52:04	31
213.168.13.151	 	 	05-21-2017 03:13:33	28
45.79.102.191	 	 	05-19-2017 03:31:00	28
52.174.38.143	 	 	05-19-2017 03:02:34	28
178.62.243.73	 	 	05-19-2017 03:01:06	28
52.26.6.169	 	 	05-19-2017 02:52:35	28
67.205.160.17	 	 	05-19-2017 02:52:27	28
45.32.249.174	 	 	05-19-2017 02:41:28	28
52.204.104.0	 	 	05-19-2017 02:36:41	28
87.224.39.215	 	 	05-19-2017 01:12:59	28
161.202.155.78	 	 	05-19-2017 01:00:33	28
69.164.196.239	 	 	05-19-2017 00:54:00	28
138.68.48.135	 	 	05-19-2017 00:34:04	28
149.56.108.121	 	 	05-19-2017 00:23:30	28
88.99.28.153	 	 	05-19-2017 00:14:49	28
37.187.76.123	 	 	05-19-2017 00:02:37	28
13.112.27.85	 	 	05-18-2017 23:35:27	28
52.63.107.125	 	 	05-18-2017 20:03:53	28
45.79.66.200	 	 	05-18-2017 19:32:05	28
95.211.121.134	 	 	05-18-2017 19:20:18	28
207.154.207.95	 	 	05-18-2017 19:18:13	28
24.6.158.242	 	 	05-18-2017 19:07:07	28
104.233.106.135	 	 	05-18-2017 19:02:00	28
62.210.252.134	 	 	05-18-2017 18:21:47	28
85.134.20.76	 	 	05-18-2017 17:17:40	28
73.189.92.164	 	 	05-18-2017 16:51:27	28
54.235.230.233	 	 	05-18-2017 14:16:27	28
176.248.180.171	 	 	05-18-2017 13:03:28	28
85.93.51.195	 	 	05-19-2017 05:33:31	27
68.60.181.146	 	 	05-19-2017 03:10:36	27
178.113.148.30	 	 	05-19-2017 02:51:21	27
173.174.124.200	 	 	05-19-2017 02:13:11	27
50.149.187.89	 	 	05-18-2017 22:39:09	27
73.206.212.211	 	 	05-18-2017 21:44:07	27
117.206.38.108	 	 	05-18-2017 16:45:02	27
183.232.29.118	 	 	05-19-2017 01:38:58	26
72.52.84.226	 	 	05-19-2017 02:36:13	25
222.209.83.73	 	 	05-19-2017 04:48:45	24
104.154.221.18	 	 	05-19-2017 03:10:03	24
216.173.137.105	 	 	05-19-2017 02:59:52	24
116.58.170.57	 	 	05-19-2017 02:47:10	24
18.248.6.175	 	 	05-19-2017 02:44:36	24
163.172.38.127	 	 	05-19-2017 02:42:18	24
188.165.227.180	 	 	05-19-2017 02:41:21	24
136.61.101.30	 	 	05-19-2017 02:35:03	24
87.118.126.124	 	 	05-19-2017 02:33:59	24
88.99.199.93	 	 	05-19-2017 02:32:02	24
45.63.65.79	 	 	05-19-2017 02:20:01	24
59.127.85.237	 	 	05-19-2017 02:11:39	24
88.99.92.72	 	 	05-19-2017 02:07:16	24
139.59.224.226	 	 	05-19-2017 01:56:03	24
104.130.204.101	 	 	05-19-2017 01:46:26	24
139.162.141.175	 	 	05-19-2017 01:45:37	24
115.236.175.122	 	 	05-19-2017 01:28:01	24
95.168.58.97	 	 	05-19-2017 01:23:35	24
103.36.84.10	 	 	05-19-2017 01:07:55	24
47.52.36.26	 	 	05-19-2017 00:57:17	24
80.192.139.207	 	 	05-19-2017 00:54:04	24
45.76.112.217	 	 	05-19-2017 00:53:07	24
45.76.148.228	 	 	05-19-2017 00:44:00	24
95.211.237.86	 	 	05-19-2017 00:07:27	24
172.104.52.80	 	 	05-18-2017 23:06:57	24
142.4.209.40	 	 	05-18-2017 21:34:30	24
126.91.14.95	 	 	05-18-2017 19:39:05	24
45.32.117.58	 	 	05-18-2017 19:35:51	24
5.12.231.162	 	 	05-18-2017 19:31:38	24
71.217.90.51	 	 	05-18-2017 19:02:08	24
47.52.39.172	 	 	05-18-2017 19:00:33	24
46.162.1.42	 	 	05-18-2017 18:48:09	24
5.35.28.10	 	 	05-18-2017 18:41:26	24
35.186.191.245	 	 	05-18-2017 18:28:36	24
137.74.3.152	 	 	05-18-2017 18:01:57	24
91.246.100.121	 	 	05-18-2017 17:32:19	24
194.87.1.232	 	 	05-18-2017 17:21:05	24
80.241.221.232	 	 	05-18-2017 17:15:57	24
149.202.184.138	 	 	05-18-2017 17:07:02	24
54.173.156.228	 	 	05-18-2017 17:02:37	24
176.26.234.85	 	 	05-18-2017 16:14:40	24
73.158.38.34	 	 	05-18-2017 15:57:38	24
76.210.228.194	 	 	05-18-2017 14:13:18	24
72.182.13.35	 	 	05-18-2017 14:12:01	24
217.122.47.17	 	 	05-18-2017 14:10:05	24
45.23.63.8	 	 	05-18-2017 12:16:05	24
80.111.172.215	 	 	05-19-2017 03:03:38	22
114.35.73.248	 	 	05-18-2017 19:12:01	22
93.72.182.90	 	 	05-19-2017 02:14:40	21
68.5.111.70	 	 	05-19-2017 01:48:01	21
195.251.124.158	 	 	05-19-2017 00:13:36	21
77.79.180.103	 	 	05-18-2017 23:57:40	21
128.125.87.203	 	 	05-18-2017 19:13:39	21
203.87.64.83	 	 	05-18-2017 18:34:56	21
107.191.104.97	 	 	05-19-2017 03:29:21	20
66.114.42.98	 	 	05-19-2017 03:22:22	20
188.24.72.21	 	 	05-19-2017 03:20:22	20
46.101.204.71	 	 	05-19-2017 03:14:22	20
176.9.19.237	 	 	05-19-2017 03:13:59	20
50.225.47.153	 	 	05-19-2017 03:13:48	20
162.243.164.156	 	 	05-19-2017 03:10:45	20
52.161.18.228	 	 	05-19-2017 03:09:44	20
151.80.96.51	 	 	05-19-2017 03:09:31	20
192.99.5.85	 	 	05-19-2017 02:58:44	20
46.138.149.57	 	 	05-19-2017 02:50:43	20
130.240.22.202	 	 	05-19-2017 02:50:02	20
138.68.145.175	 	 	05-19-2017 02:45:46	20
173.192.160.222	 	 	05-19-2017 02:43:04	20
78.56.33.225	 	 	05-19-2017 02:17:53	20
88.99.192.164	 	 	05-19-2017 02:10:34	20
13.66.57.162	 	 	05-19-2017 02:00:45	20
51.15.135.237	 	 	05-19-2017 01:47:26	20
137.74.46.89	 	 	05-19-2017 01:43:51	20
79.98.29.93	 	 	05-19-2017 01:37:48	20
52.168.150.50	 	 	05-19-2017 01:34:56	20
139.59.43.56	 	 	05-19-2017 01:32:03	20
74.15.112.89	 	 	05-19-2017 01:16:53	20
213.231.4.18	 	 	05-19-2017 01:11:44	20
138.201.139.215	 	 	05-19-2017 01:09:08	20
87.229.63.5	 	 	05-19-2017 00:58:06	20
207.154.200.64	 	 	05-19-2017 00:00:39	20
73.74.204.238	 	 	05-18-2017 22:14:14	20
144.217.238.161	 	 	05-18-2017 20:37:44	20
94.242.229.4	 	 	05-18-2017 20:04:00	20
213.136.71.143	 	 	05-18-2017 20:03:09	20
5.39.79.51	 	 	05-18-2017 19:45:24	20
118.103.126.140	 	 	05-18-2017 19:28:57	20
178.238.236.169	 	 	05-18-2017 19:15:32	20
68.199.230.8	 	 	05-18-2017 19:04:38	20
144.76.238.49	 	 	05-18-2017 19:02:12	20
35.166.117.94	 	 	05-18-2017 18:56:25	20
123.243.6.18	 	 	05-18-2017 18:52:20	20
45.32.253.23	 	 	05-18-2017 18:35:17	20
71.88.44.248	 	 	05-18-2017 17:09:27	20
45.76.2.199	 	 	05-18-2017 16:58:55	20
221.143.48.160	 	 	05-18-2017 15:48:09	20
138.197.152.24	 	 	05-18-2017 14:36:59	20
188.40.118.148	 	 	05-20-2017 19:49:42	19
86.147.77.89	 	 	05-19-2017 03:11:30	18
136.60.165.133	 	 	05-19-2017 03:10:19	18
95.220.210.56	 	 	05-19-2017 02:47:39	18
45.56.33.21	 	 	05-19-2017 02:32:21	18
141.168.96.122	 	 	05-19-2017 02:28:00	18
91.201.25.145	 	 	05-19-2017 02:00:44	18
59.10.140.44	 	 	05-19-2017 01:21:14	18
135.0.151.143	 	 	05-18-2017 21:46:52	18
212.56.108.81	 	 	05-18-2017 18:58:06	18
188.192.90.218	 	 	05-18-2017 17:08:18	18
24.226.88.180	 	 	05-18-2017 17:05:45	18
188.64.128.175	 	 	05-18-2017 14:34:55	18
149.202.184.140	 	 	05-19-2017 03:21:45	17
45.76.171.135	 	 	05-19-2017 01:49:02	17
52.55.37.26	 	 	05-20-2017 07:59:07	16
188.24.50.216	 	 	05-19-2017 03:21:44	16
104.237.2.90	 	 	05-19-2017 03:14:39	16
74.68.105.77	 	 	05-19-2017 03:06:47	16
52.208.46.161	 	 	05-19-2017 03:00:18	16
91.121.65.105	 	 	05-19-2017 02:57:12	16
74.207.244.183	 	 	05-19-2017 02:52:47	16
45.52.91.216	 	 	05-19-2017 02:46:16	16
67.205.160.207	 	 	05-19-2017 02:34:17	16
52.184.197.9	 	 	05-19-2017 02:30:53	16
Showing 1 to 250 of 250 entries

[ando1]

@johnpoz:

you sure some of those are not out of state hits?  The udp is all just noise.. I really see no pint in logging it to be honest..

If those are SYN hits, then yes its directed traffic.  If its out of state its possible it just left over packets from after you closed a session, etc… your 23, 22, 1433 are real common you will see lots of those.  Bots searching the net for open shit hey can try and exploit.  The high ports could be just junk.

It is curious that your seeing a few ports make up large % of it though.. I checked my logs I have not seen any hits to 30303 tcp at all..

Again what is the time frame in these graphs, last 24 hours?  Last hour? etc..  If your curious do a packet capture on your wan on that port and might give you some insight to what it is.  For sure will tell you if syn or just out of state ack.  If ack, take a look at your state table do you see any traffic going somewhere with that 30303 as source port?

I checked my firewall log this morning and some are TCP:S and the others are UDP. This port is still in the top 2 of overall blocks along with port 1433. As for the timeframe in my screen shots from the last post, that was a 2 week snap shot. I did a 2 day snapshot it is posted below.

[johnpoz]

The pfmonitor doesn't really have a lot of players in it reporting traffic..  But its odd that it is showing that many hits while dshields is showing like nothing

https://www.dshield.org/port.html?port=30303

[ando1]

Just an update. port 30303 tapered off for a few day (was about 30% of blocked) and now it is back up. Should I be concerned here?

[pfBasic]

I wouldn't think so considering it's being blocked.

[johnpoz]

Should you be concerned with any of the other ports that are being blocked?  Unless it was 1000's of hits a seconds its just noise like everything else..

[Harvy66]

I'm blocking an average of 10pps. Some days it's about 5pps and others it's about 15pps. 9200 blocked packets is 10min-30min of activity on my home connection.

[johnpoz]

So very low level background noise then..