Why there are a lot of packets not related to my IP been captured with tcpdump ? (Centos 7)

Question

Tcpdump running by :

/usr/sbin/tcpdump -U -n -i eth0 icmp or tcp dst port 22 or tcp dst port

When I review the captured data , it shows :

132.132.211.221.40372 > 89.31.125.17.ssh: Flags [S], cksum 0xde63 (correct), seq 524121044, win 29200, length 0
146.136.44.207.4855 > 45.66.134.253.ssh: Flags [S], cksum 0x86a2 (correct), seq 1106964113, win 29200, length 0
46.228.217.79.64595 > 81.90.190.31.ssh: Flags [S], cksum 0xdf11 (correct), seq 4132328538, win 29200, length 0
109.89.72.226.19846 > 89.31.126.248.ssh: Flags [S], cksum 0xf42c (correct), seq 2627129631, win 29200, length 0
186.102.253.234.58270 > 45.146.123.96.ssh: Flags [S], cksum 0xc8a3 (correct), seq 3373229862, win 29200, length 0
139.204.89.135.64050 > 81.90.190.31.ssh: Flags [S], cksum 0x9afe (correct), seq 3997943153, win 29200, length 0
146.17.189.108.mbl-battd > 45.66.134.42.ssh: Flags [S], cksum 0xbf0e (correct), seq 1369840100, win 29200, length 0

So , the strange thing is all these address , neither SCR, nor DST is my IP address ! Does it mean that someone is using my host as a "relay" to attack other's SSH ?

Letting me post the iptables's ruler and log here for reference :

-P FORWARD DROP
-A FORWARD -p tcp -m tcp --dport 22 -j LOG --log-prefix "[forward_ssh] "
-A OUTPUT  -p tcp -m tcp --dport 22 -m state --state NEW -j LOG --log-uid --log-prefix  "[out_ssh_new] "
-A OUTPUT  -p tcp -m tcp --dport 22 -m state --state ESTABLISHED -j LOG --log-uid --log-prefix "[out_ssh_est] "
-A OUTPUT  -p tcp -m tcp --dport 22 -j DROP

The log showed below , it seems my IP (194.156.xxx.xxx) is attacking others ....

Mar 15 08:56:35 oneserver kernel: [out_ssh_est] IN= OUT=eth0 SRC=194.156.xxx.xxx DST=2.59.135.116 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=443 DPT=22 WINDOW=64240 RES=0x00 ACK SYN URGP=0
Mar 15 09:21:02 oneserver kernel: [out_ssh_est] IN= OUT=eth0 SRC=194.156.xxx.xxx DST=162.248.88.193 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=443 DPT=22 WINDOW=64240 RES=0x00 ACK SYN URGP=0
Mar 15 10:52:45 oneserver kernel: [out_ssh_est] IN= OUT=eth0 SRC=194.156.xxx.xxx DST=172.106.16.136 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=443 DPT=22 WINDOW=64240 RES=0x00 ACK SYN URGP=0

Are you using a web interface to access the VPS console or did you ssh into the VPS from your local system's terminal? — ILMostro_7, Mar 17 '20 at 06:47

nobody · Answer 1 · 2020-03-17T06:13:32.507

Tcpdump puts your network interface in "promiscuous" mode. If you have a hub on the network it sends all packets to all interfaces. An interface then checks MAC number and sees if the packet is for that interface. If it is, it forwards it to the receiving software. If not, it drops the packet.

However in promiscuous mode the interface can receive all packets. For instance, to display it with tcpdump.

If you have a switch instead of a hub, switch should filter packets and send you only the ones that are really for you. For multicast traffic the scenario is more complicated, and I will not explain it here.

Network equipment does not route traffic according to IP numbers but according to MAC numbers.

Take a look here for more information

Following you comment here is some additional information:

You wonder what are logs that iptables produce. One thing is that you show only logs of an established connection. When connection was established there should also be logs about it. That means that this connections are already established and working. Try to find out, which processes use these connections, with lsof utility. When you have the process name, you should be able to identify, whether the connection is legal or not.

If you suspect that your computer might be compromised, I would suggest some checks. See if you have something installed that you do not recognize. For RedHat/CentOS/Fedora/Oracle linux, which use RPM/YUM packages, you can check it easily with few commands:

rpm -qa will list all installed packages. See if there are some suspicious.
rpm -Va will display all files that have changed after packages were installed. See, which files have changed.
You can also check source of the package, although the information may be fake. https://serverfault.com/questions/62026/how-to-know-from-which-yum-repository-a-package-has-been-installed

For other distributions find for yourself, how to check the installation integrity.

After put my NIC in normal mode , no strange packets captured by tcpdump . But how to explain the iptables log showed ? Mar 15 10:52:45 oneserver kernel: [out_ssh_est] IN= OUT=eth0 SRC=194.156.xxx.xxx DST=172.106.16.136 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=443 DPT=22 WINDOW=64240 RES=0x00 ACK SYN URGP=0 — wwlh, Mar 16 '20 at 09:41

score 1 · Answer 2 · answered Mar 15 '20 at 09:41

Tcpdump will listen to all packets that go past your network interface. An ethernet switch will do its best to only pass on packets addressed to your MAC. A non-switching-hub, will not event try, it will show you everything.

Therefore you will receive all the packets on your lan. Normally we would not expect packets from such a diverse set of IP addresses. However upon looking up your IP address, we discover that you are in a data-center, belonging to Petersburg Internet Network ltd. Do they route internet traffic? Could this traffic be going past your machine.

Please find a safer place to do your training.

Thanks for your answer ! My machine is a VPS . I am concerned that why there are some ssh traffic goes from my 443 port to other's 22 port ? — wwlh, Mar 16 '20 at 09:46

Why there are a lot of packets not related to my IP been captured with tcpdump ? (Centos 7)

2 Answers2