Network traffic debugging - noticed a lot of traffic from different ports in my VM

dgarg

2/10/23, 7:10 AM

I am on a quest to analyze high egress traffic from my VM. Analyzing iftop logs, I noticed that a lot of traffic is conducted from different ports of my VM such as :42272, :42292, :42294, :55166 etc.

Below is the capture of iftop -P -t -L 10000 | grep "=>" |grep -v https I have masked my ip address as xx.xxx.x.x

  1 xx.xxx.x.x:ssh                           =>      142KB     67.8KB     67.8KB      542KB
 561 xx.xxx.x.x:42272                         =>       688B       172B       172B     1.34KB
 562 xx.xxx.x.x:42292                         =>       688B       172B       172B     1.34KB
 563 xx.xxx.x.x:42294                         =>       687B       172B       172B     1.34KB
 564 xx.xxx.x.x:55166                         =>         0B       172B       172B     1.34KB
 565 xx.xxx.x.x:42322                         =>       686B       172B       172B     1.34KB
 566 xx.xxx.x.x:42234                         =>         0B       171B       171B     1.34KB
 567 xx.xxx.x.x:42306                         =>       684B       171B       171B     1.33KB
 568 xx.xxx.x.x:42340                         =>       684B       171B       171B     1.33KB
 569 xx.xxx.x.x:55276                         =>         0B       171B       171B     1.34KB
 570 xx.xxx.x.x:42336                         =>       683B       171B       171B     1.33KB
 571 xx.xxx.x.x:42194                         =>         0B       171B       171B     1.33KB
 572 xx.xxx.x.x:55280                         =>         0B       171B       171B     1.33KB
 573 xx.xxx.x.x:42282                         =>       681B       170B       170B     1.33KB
 574 xx.xxx.x.x:55178                         =>         0B       170B       170B     1.33KB
 575 xx.xxx.x.x:42274                         =>       680B       170B       170B     1.33KB
 576 xx.xxx.x.x:42196                         =>         0B       170B       170B     1.32KB

I dont know what this traffic is. I think all the traffic to my VM should be through apache server (port 443) and a little bit from :22 for my ssh.

When I count the bytes sent through above ports, it is not much .. about 32KB/s but still if it is an attack, i would like to fix it.

So is this traffic for these suspicious ports legitimate? If not, what should be my next steps..

0 + 0

networking

linux

port-scanning

network-traffic

apache-2.2

Gerald Schneider

2/10/23, 7:28 AM

please provide actual examples, the output of your commands, log files, etc. We can't guess.

dgarg

2/10/23, 7:10 PM

I have added the output of iftop showing the ports. I can add more details as needed. Not sure what should i add.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Network traffic debugging - noticed a lot of traffic from different ports in my VM

TH: การดีบักการรับส่งข้อมูลเครือข่าย - สังเกตเห็นการรับส่งข้อมูลจำนวนมากจากพอร์ตต่างๆ ใน VM ของฉัน

RO: Depanarea traficului de rețea - am observat mult trafic de la diferite porturi din VM-ul meu

RU: Отладка сетевого трафика - заметил много трафика с разных портов на моей виртуальной машине

VI: Gỡ lỗi lưu lượng mạng - nhận thấy rất nhiều lưu lượng truy cập từ các cổng khác nhau trong máy ảo của tôi

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.