Home / server / Questions / 118357
Accepted
Jakub
Asked: 2010-03-03 08:15:13 +0800 CST

Anyone else being hit by traffic on TCP port 11370

  • 772

I've been watching my logs (Ubuntu 9.10 server) and dunno about any of you but I am getting a ton of traffic from sources like Russia, Romania, etc.. on port 11370 (my iptables are logndrop'ing it. But was just curious).

Some googling revealed this info:
http://www.keysigning.org/sks/ -which seems to use port 11370 & 11371

Could that be the service they are scanning for (i don't run it)?

ICS shows this: https://isc.incidents.org/port.html?port=11370

Just curious what you guys think and if anyone has seen this before? If need be I can post my log on here, but its just a dropped log of TCP port 11370 from various IPs.

Thought it was strange as thats the ONLY Port I seem to repeatedly be hit on (from logs).

I'm running on a Linode (VPS) if that matters to annyone.

firewall log-files security iptables

2 Answers

  1. Best Answer

    Open (socat -v tcp-l:11370,reuseaddr -) this port and watch what goes to it

    Alternatively, redirect the traffic somewhere to analyse using iptables.

    /* Note: comments and votes were for other, shorter formulation */

    • 2

  2. Maybe this is some new zeroday exploit on a service that runs on that, or a some kind of backdoor rat. checkout http://www.dshield.org/trends.html. Consider offering your firewall logs to them.

    If you on your server an want to check if a process is listening on that port just do

    netstat -l -p -d | grep 11370

    also if you see unknown port numbers doing

    cat /etc/services | grep 11370

    come up blank on my machine.

    I think (if it's still available) tcpview.exe on windows to do the same job.

    • 0