[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 383
  • Last Modified:

Strange activity reported by sniffer

Hi experts. I have a question for you. I am using EtherDetect Packet Sniffer to monitor my LAN activities. According to the Traffic Report Window, there is the following activity going on:

Start Time 14:10:19.992
Client IP Port: 64.236.34.67:80
Server IP Port: 192.168.2.106:3671 (This is one of my LAN machines.
Protocol: TCP:http
Packets: 10459

This seems bizarre since the rest of the lines show very little activity (all of them are under 100).
And I wonder why one of my machines is acting as a server. Any idea of what this could be? Any solution to the apparent problem?
Thnks
0
Jewels1
Asked:
Jewels1
  • 3
  • 2
  • 2
  • +1
1 Solution
 
mikebernhardtCommented:
Is that client address on the outside or the inside? If outside addresses can get to inside addresses like that you really need to check on your internet security.

Well, have you checked if that machine is running web services? Kaazaa and some related file-sharing apps can use port 80. So do many worms. You should really check out the LAN machine in question.
0
 
bfarmerCommented:
The client and server should be switched.

Client IP Port - 192.168.2.106:3671

Server IP Port - 64.236.34.67:80   (80 is the default port for HTTP)

http://64.236.34.67

ICY 404 Resource Not Found
icy-notice1:SHOUTcast Distributed Network Audio Server/posix v1.8.1<BR>
icy-notice2:The resource requested was not found<BR>

Looks like they're getting streaming audio from the site...
0
 
mikebernhardtCommented:
Oh yeah, didn't notice the client port is 80... your software may be just reading the conversation backwards.
0
Restore individual SQL databases with ease

Veeam Explorer for Microsoft SQL Server delivers an easy-to-use, wizard-driven interface for restoring your databases from a backup. No expert SQL background required. Web interface provides a complete view of all available SQL databases to simplify the recovery of lost database

 
Jewels1Author Commented:
Well, the client address is definitely outside (My machines go from 192.168.100 to 106). Do you suggest I block port 80 from my router? I am pretty sure my machine is malware-free but I'll doublecheck
0
 
cyrusunccCommented:
is 64.236.34.67 the ip address given by your isp?

go to http://www.whatismyip.com/

see if the traffic is internal or external....

try installing zonealarm on 192.168.2.106 computer and see whats going in or out


0
 
cyrusunccCommented:
try forwarding all port 80 requests to 192.168.0.200 (not a computer)

that way all port 80 requests will not be answered by that computer
0
 
mikebernhardtCommented:
If the outside machine is on port 80, which I didn't notice at first, then this is likely part of a session initiated by your inside machine. An outside machine can't just connect to some high-numbered port on your PC unless it has a service running there. If you block inbound traffic from port 80 you'll block all web access from your LAN- no traffic will be able to come back.
0
 
Jewels1Author Commented:
You are right Bfarmer. I just found out the user is receiving streaming audio from an online radio website. This matches the description of the problem. Thanks to all.
0
 
bfarmerCommented:
Jewels1 -

This looks like legitimate traffic, just perhaps not desirable due to bandwidth usage.  If you have a policy against streaming audio, slap the user on the wrist.  If not, then don't worry about it.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 3
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now