[plug] was I probed or ignorantly paranoid?
Gavin Chester
gavinchester1 at hotmail.com
Wed Mar 30 01:28:40 WST 2005
I'm not sure whether I was probed or whether I saw some normal traffic
to my machine. Either way it seemed strange to have many repeat ssh
requests when no one should be ssh-ing into my PC. Maybe you guys could
shed some light for me? I'm a newbie to many Linux concepts - especially
security :-0. I run a fairly stock-standard FC3 install with as few
services active as possible and a generic (read as un-tweaked) firewall
in place. I was watching network activity on my modem and checked out
what it could be with ethereal to capture the packets. Here is a small
sample of the trace where ssh was repeated over and over with attempts
to exchange keys:
###############################
47502 32040.681196 jarrah-51.eftel.com 61.103.229.204
SSHv2 Server Protocol: SSH-1.99-OpenSSH_3.9p1
47503 32041.149241 61.103.229.204 jarrah-51.eftel.com
SSHv2 Client Protocol: SSH-2.0-libssh-0.1\r
47504 32041.149570 jarrah-51.eftel.com 61.103.229.204 TCP
ssh > 56327 [ACK] Seq=24 Ack=21 Win=5792 Len=0 TSV=175579911
TSER=81751857
47505 32041.153191 jarrah-51.eftel.com 61.103.229.204
SSHv2 Server: Key Exchange Init
47506 32041.154988 61.103.229.204 jarrah-51.eftel.com TCP
56327 > ssh [ACK] Seq=1 Ack=24 Win=5840 Len=0 TSV=81751857
TSER=175579443
47507 32041.155135 jarrah-51.eftel.com 61.103.229.204 TCP
[TCP Dup ACK 47504#1] ssh > 56327 [ACK] Seq=664 Ack=21 Win=5792 Len=0
TSV=175579917 TSER=81751857
47508 32041.716149 61.103.229.204 jarrah-51.eftel.com
SSHv2 Client: Key Exchange Init
47509 32041.755968 jarrah-51.eftel.com 61.103.229.204 TCP
ssh > 56327 [ACK] Seq=664 Ack=173 Win=5792 Len=0 TSV=175580518
TSER=81751915
47510 32042.253834 61.103.229.204 jarrah-51.eftel.com
SSHv2 Client: Diffie-Hellman Key Exchange Init
47511 32042.253975 jarrah-51.eftel.com 61.103.229.204 TCP
ssh > 56327 [ACK] Seq=664 Ack=317 Win=5792 Len=0 TSV=175581016
TSER=81751964
47512 32042.304556 jarrah-51.eftel.com 61.103.229.204
SSHv2 Server: New Keys
47513 32042.933718 61.103.229.204 jarrah-51.eftel.com
SSHv2 Client: New Keys
47514 32042.934044 jarrah-51.eftel.com 61.103.229.204 TCP
ssh > 56327 [ACK] Seq=1128 Ack=333 Win=5792 Len=0 TSV=175581696
TSER=81752035
47515 32043.406662 61.103.229.204 jarrah-51.eftel.com
SSHv2 Client: Unknown (244)
47516 32043.406972 jarrah-51.eftel.com 61.103.229.204 TCP
ssh > 56327 [ACK] Seq=1128 Ack=385 Win=5792 Len=0 TSV=175582169
TSER=81752083
47517 32043.407284 jarrah-51.eftel.com 61.103.229.204
SSHv2 Server: Unknown (192)
47518 32043.936563 61.103.229.204 jarrah-51.eftel.com
SSHv2 Encrypted request packet len=84
47519 32043.976628 jarrah-51.eftel.com 61.103.229.204 TCP
ssh > 56327 [ACK] Seq=1180 Ack=469 Win=5792 Len=0 TSV=175582739
TSER=81752134
47520 32046.334601 jarrah-51.eftel.com 61.103.229.204
SSHv2 Encrypted response packet len=84
47521 32046.855120 61.103.229.204 jarrah-51.eftel.com
SSHv2 Encrypted request packet len=52
47522 32046.855261 jarrah-51.eftel.com 61.103.229.204 TCP
ssh > 56327 [ACK] Seq=1264 Ack=521 Win=5792 Len=0 TSV=175585618
TSER=81752425
47523 32046.857651 jarrah-51.eftel.com 61.103.229.204 TCP
ssh > 56327 [FIN, ACK] Seq=1264 Ack=521 Win=5792 Len=0 TSV=175585620
TSER=81752425
###############################
It went on like this over and over for about 10mins. FYI: My ISP is
eftel.com and I did a whois on the the other joker and found them in
Korea:
#############################
#whois 61.103.229.204
IPv4 Address : 61.103.229.0-61.103.229.255
Network Name : DREAMX-CATV-DAECHEON-SR
Connect ISP Name : DREAMX
Connect Date : 20020325
Registration Date : 20020424
[ Organization Information ]
Organization ID : ORG242785
Org Name : Daecheon Catv
State : CHUNGNAM
Address : 562-1, Dongdae-dong, Boryeong-si
Zip Code : 355-140
[ Admin Contact Information]
Name : Changjae Lim
Org Name : Daecheon Catv
State : CHUNGNAM
Address : 562-1, Dongdae-dong, Boryeong-si
Zip Code : 355-140
Phone : +82-41-931-3844
Fax : +82-41-933-3846
E-Mail : qkdthdtk at hanmail.net
[ Technical Contact Information ]
Name : Changjae Lim
Org Name : Daecheon Catv
State : CHUNGNAM
Address : 562-1, Dongdae-dong, Boryeong-si
Zip Code : 355-140
Phone : +82-41-931-3844
Fax : +82-41-933-3846
E-Mail : qkdthdtk at hanmail.net
#########################
It _seems_ as though his attempts to ssh into my PC were unsuccessful,
but could you guys confirm that from the limited trace I pasted above?
Needless to say I killed ssh as a service since I am not using it and
only had there "in case" I did want it sometime soon.
Regards, Gavin
More information about the plug
mailing list