Why is Google approaching my VPS machine?Network activity through port 17500iptables drops some packets on port 80 and i don't know the causeIPTables Logging a Flood of “TCP INCOMPLETE” MessagesIptables ESTABLISHED,RELATED chain problemsiptables: How to read this OPT string?Understanding log messages from iptablesWhy do some outgoing IP traffic not contain UID information?OpenVPN Access Server: Remote Subnet Cannot Access Client's ResourcesHow to ACCEPT multicast connection with iptables's rule?debian kvm server with iptables is dropping bridge packetsIPTables blocking port despite Allow rule
Possible executive assistant job scam
Check the validity of a 10-digit telephone number
CO₂ level is high enough that it reduces cognitive ability. Isn't that a reason to worry?
SD Card speed degrading and doesn't work on one of my cameras: can I do something?
Visiting a place in Brussels where Pink Floyd recorded a video
What is a good way to challenge a Warlock with the Agonizing Blast invocation?
Is it sportsmanlike to waste opponents' time by giving check at the end of the game?
What are these criss-cross patterns close to Cambridge Airport (UK)?
Should a middle class person emulate a very wealthy investor for % of cash hold?
How do I find the unknown program enabled during Start-Up?
Why do the US media keep claiming that Iran is violating their nuclear deal even though the deal was withdrawn by the US?
Why did Leia not want to tell Han about Luke being her twin brother?
What type of beer is best for beer battered fish?
When should we use "Got it?" and "Get it?"
An historical mystery : Poincaré’s silence on Lebesgue integral and measure theory?
Could you fly a Boeing 747 on Venus?
What is the difference between turbojet and turbofan engines?
Implement the Max-Pooling operation from Convolutional Neural Networks
Improving the observation skill & making less blunders
Do modern jet engines need igniters?
How do the Martian rebels defeat Earth when they're grossly outnumbered and outgunned?
How to avoid answering "what were you sick with"?
Can "marriage" be used as a verb?
Constraint of NDSolve with an integral of the solution
Why is Google approaching my VPS machine?
Network activity through port 17500iptables drops some packets on port 80 and i don't know the causeIPTables Logging a Flood of “TCP INCOMPLETE” MessagesIptables ESTABLISHED,RELATED chain problemsiptables: How to read this OPT string?Understanding log messages from iptablesWhy do some outgoing IP traffic not contain UID information?OpenVPN Access Server: Remote Subnet Cannot Access Client's ResourcesHow to ACCEPT multicast connection with iptables's rule?debian kvm server with iptables is dropping bridge packetsIPTables blocking port despite Allow rule
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
I'm trying to track network activities on my machine running CentOS 7.
According to iptables logs, it seems that Google (74.125.133.108) is approaching my VPS many times.
I can see that source-port is always 993.
What is the reason for that?
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=60 TOS=0x00 PREC=0xA0 TTL=107 ID=4587 PROTO=TCP SPT=993 DPT=47920 WINDOW=62392 RES=0x00 ACK SYN URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4666 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=2767 TOS=0x00 PREC=0xA0 TTL=107 ID=4668 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=331 TOS=0x00 PREC=0xA0 TTL=107 ID=4704 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=150 TOS=0x00 PREC=0xA0 TTL=107 ID=4705 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=299 TOS=0x00 PREC=0xA0 TTL=107 ID=4733 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4771 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=354 TOS=0x00 PREC=0xA0 TTL=107 ID=5026 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5094 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=128 TOS=0x00 PREC=0xA0 TTL=107 ID=5116 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5187 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=124 TOS=0x00 PREC=0xA0 TTL=107 ID=5189 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5195 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=339 TOS=0x00 PREC=0xA0 TTL=107 ID=5213 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=119 TOS=0x00 PREC=0xA0 TTL=107 ID=5214 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5229 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5257 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK FIN URGP=0
iptables
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
asked Jul 17 at 13:34
ishahakishahak
3163 silver badges7 bronze badges
add a comment
|
I'm trying to track network activities on my machine running CentOS 7.
According to iptables logs, it seems that Google (74.125.133.108) is approaching my VPS many times.
I can see that source-port is always 993.
What is the reason for that?
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=60 TOS=0x00 PREC=0xA0 TTL=107 ID=4587 PROTO=TCP SPT=993 DPT=47920 WINDOW=62392 RES=0x00 ACK SYN URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4666 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=2767 TOS=0x00 PREC=0xA0 TTL=107 ID=4668 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=331 TOS=0x00 PREC=0xA0 TTL=107 ID=4704 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=150 TOS=0x00 PREC=0xA0 TTL=107 ID=4705 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=299 TOS=0x00 PREC=0xA0 TTL=107 ID=4733 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4771 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=354 TOS=0x00 PREC=0xA0 TTL=107 ID=5026 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5094 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=128 TOS=0x00 PREC=0xA0 TTL=107 ID=5116 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5187 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=124 TOS=0x00 PREC=0xA0 TTL=107 ID=5189 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5195 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=339 TOS=0x00 PREC=0xA0 TTL=107 ID=5213 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=119 TOS=0x00 PREC=0xA0 TTL=107 ID=5214 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5229 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5257 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK FIN URGP=0
iptables
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
asked Jul 17 at 13:34
ishahakishahak
3163 silver badges7 bronze badges
add a comment
|
I'm trying to track network activities on my machine running CentOS 7.
According to iptables logs, it seems that Google (74.125.133.108) is approaching my VPS many times.
I can see that source-port is always 993.
What is the reason for that?
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=60 TOS=0x00 PREC=0xA0 TTL=107 ID=4587 PROTO=TCP SPT=993 DPT=47920 WINDOW=62392 RES=0x00 ACK SYN URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4666 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=2767 TOS=0x00 PREC=0xA0 TTL=107 ID=4668 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=331 TOS=0x00 PREC=0xA0 TTL=107 ID=4704 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=150 TOS=0x00 PREC=0xA0 TTL=107 ID=4705 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=299 TOS=0x00 PREC=0xA0 TTL=107 ID=4733 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4771 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=354 TOS=0x00 PREC=0xA0 TTL=107 ID=5026 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5094 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=128 TOS=0x00 PREC=0xA0 TTL=107 ID=5116 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5187 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=124 TOS=0x00 PREC=0xA0 TTL=107 ID=5189 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5195 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=339 TOS=0x00 PREC=0xA0 TTL=107 ID=5213 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=119 TOS=0x00 PREC=0xA0 TTL=107 ID=5214 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5229 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5257 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK FIN URGP=0
iptables
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
asked Jul 17 at 13:34
ishahakishahak
3163 silver badges7 bronze badges
I'm trying to track network activities on my machine running CentOS 7.
According to iptables logs, it seems that Google (74.125.133.108) is approaching my VPS many times.
I can see that source-port is always 993.
What is the reason for that?
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=60 TOS=0x00 PREC=0xA0 TTL=107 ID=4587 PROTO=TCP SPT=993 DPT=47920 WINDOW=62392 RES=0x00 ACK SYN URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4666 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=2767 TOS=0x00 PREC=0xA0 TTL=107 ID=4668 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=331 TOS=0x00 PREC=0xA0 TTL=107 ID=4704 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=150 TOS=0x00 PREC=0xA0 TTL=107 ID=4705 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=299 TOS=0x00 PREC=0xA0 TTL=107 ID=4733 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4771 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=354 TOS=0x00 PREC=0xA0 TTL=107 ID=5026 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5094 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=128 TOS=0x00 PREC=0xA0 TTL=107 ID=5116 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5187 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=124 TOS=0x00 PREC=0xA0 TTL=107 ID=5189 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5195 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=339 TOS=0x00 PREC=0xA0 TTL=107 ID=5213 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=119 TOS=0x00 PREC=0xA0 TTL=107 ID=5214 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5229 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5257 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK FIN URGP=0
iptables
iptables
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
asked Jul 17 at 13:34
ishahakishahak
3163 silver badges7 bronze badges
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
asked Jul 17 at 13:34
ishahakishahak
3163 silver badges7 bronze badges
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
2,1765 gold badges22 silver badges24 bronze badges
asked Jul 17 at 13:34
ishahakishahak
3163 silver badges7 bronze badges
asked Jul 17 at 13:34
ishahakishahak
3163 silver badges7 bronze badges
asked Jul 17 at 13:34
ishahakishahak
3163 silver badges7 bronze badges
3163 silver badges7 bronze badges
add a comment
|
add a comment
|
2 Answers
2
active
oldest
votes
Notice the ACK SYN on the first packet in your dump? Those flags indicate the second stage of the three-way TCP handshake.
Since this packet is coming from Google, it indicates that Google is not "approaching your VPS"; your VPS is connecting to Google on port 993, and Google is sending back an acknowledgement.
To investigate this further, you can use the iptables command to view details (including process IDs) of connections that are currently active. You can also use the kernel audit subsystem to log outgoing connections as they happen.
answered Jul 17 at 23:30
DavidDavid
7161 gold badge5 silver badges5 bronze badges
10
Thanks for solving this mystery. Indeed I do have a process that downloads email from Google. Special thanks for suggesting the auditctl tool!
– ishahak
Jul 18 at 8:29
add a comment
|
Port 993 is for encrypted IMAP traffic.
Gmail has a feature where it can check external IMAP servers and bring those emails into your inbox.
As such, I suspect your IP address was previously that of someone's email server, and they configured Gmail to check that server for their emails. (Alternatively, but less likely, that "someone" is you, and you forgot you did this.)
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
answered Jul 17 at 14:03
ceejayozceejayoz
28.3k6 gold badges70 silver badges97 bronze badges
10
This might plausibly explain why the destination port would be 993/tcp, but in OP's case, it's the source port. The destination port is 47920/tcp.
– a CVn
Jul 17 at 22:19
6
@aCVn Which suggests that the OP might be connecting to Google, instead of the other way around...
– marcelm
Jul 17 at 23:12
4
@marcelm That is indeed the case, as indicated by theACK SYNflags on the first packet in the list. I've posted a more detailed explanation as an answer.
– David
Jul 17 at 23:31
1
@marcelm Maybe there is malware on the server attempting to send spam via gmail somehow.
– Qwertie
Jul 18 at 7:17
2
@Qwertie: Most malware sending spam would go for SMTP ports (25/465/587) and wouldn't bother with IMAP.
– grawity
Jul 18 at 13:20
add a comment
|
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f975594%2fwhy-is-google-approaching-my-vps-machine%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Notice the ACK SYN on the first packet in your dump? Those flags indicate the second stage of the three-way TCP handshake.
Since this packet is coming from Google, it indicates that Google is not "approaching your VPS"; your VPS is connecting to Google on port 993, and Google is sending back an acknowledgement.
To investigate this further, you can use the iptables command to view details (including process IDs) of connections that are currently active. You can also use the kernel audit subsystem to log outgoing connections as they happen.
answered Jul 17 at 23:30
DavidDavid
7161 gold badge5 silver badges5 bronze badges
10
Thanks for solving this mystery. Indeed I do have a process that downloads email from Google. Special thanks for suggesting the auditctl tool!
– ishahak
Jul 18 at 8:29
add a comment
|
Notice the ACK SYN on the first packet in your dump? Those flags indicate the second stage of the three-way TCP handshake.
Since this packet is coming from Google, it indicates that Google is not "approaching your VPS"; your VPS is connecting to Google on port 993, and Google is sending back an acknowledgement.
To investigate this further, you can use the iptables command to view details (including process IDs) of connections that are currently active. You can also use the kernel audit subsystem to log outgoing connections as they happen.
answered Jul 17 at 23:30
DavidDavid
7161 gold badge5 silver badges5 bronze badges
10
Thanks for solving this mystery. Indeed I do have a process that downloads email from Google. Special thanks for suggesting the auditctl tool!
– ishahak
Jul 18 at 8:29
add a comment
|
Notice the ACK SYN on the first packet in your dump? Those flags indicate the second stage of the three-way TCP handshake.
Since this packet is coming from Google, it indicates that Google is not "approaching your VPS"; your VPS is connecting to Google on port 993, and Google is sending back an acknowledgement.
To investigate this further, you can use the iptables command to view details (including process IDs) of connections that are currently active. You can also use the kernel audit subsystem to log outgoing connections as they happen.
answered Jul 17 at 23:30
DavidDavid
7161 gold badge5 silver badges5 bronze badges
Notice the ACK SYN on the first packet in your dump? Those flags indicate the second stage of the three-way TCP handshake.
Since this packet is coming from Google, it indicates that Google is not "approaching your VPS"; your VPS is connecting to Google on port 993, and Google is sending back an acknowledgement.
To investigate this further, you can use the iptables command to view details (including process IDs) of connections that are currently active. You can also use the kernel audit subsystem to log outgoing connections as they happen.
answered Jul 17 at 23:30
DavidDavid
7161 gold badge5 silver badges5 bronze badges
answered Jul 17 at 23:30
DavidDavid
7161 gold badge5 silver badges5 bronze badges
answered Jul 17 at 23:30
DavidDavid
7161 gold badge5 silver badges5 bronze badges
answered Jul 17 at 23:30
DavidDavid
7161 gold badge5 silver badges5 bronze badges
7161 gold badge5 silver badges5 bronze badges
10
Thanks for solving this mystery. Indeed I do have a process that downloads email from Google. Special thanks for suggesting the auditctl tool!
– ishahak
Jul 18 at 8:29
add a comment
|
10
Thanks for solving this mystery. Indeed I do have a process that downloads email from Google. Special thanks for suggesting the auditctl tool!
– ishahak
Jul 18 at 8:29
10
10
Thanks for solving this mystery. Indeed I do have a process that downloads email from Google. Special thanks for suggesting the auditctl tool!
– ishahak
Jul 18 at 8:29
Thanks for solving this mystery. Indeed I do have a process that downloads email from Google. Special thanks for suggesting the auditctl tool!
– ishahak
Jul 18 at 8:29
add a comment
|
Port 993 is for encrypted IMAP traffic.
Gmail has a feature where it can check external IMAP servers and bring those emails into your inbox.
As such, I suspect your IP address was previously that of someone's email server, and they configured Gmail to check that server for their emails. (Alternatively, but less likely, that "someone" is you, and you forgot you did this.)
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
answered Jul 17 at 14:03
ceejayozceejayoz
28.3k6 gold badges70 silver badges97 bronze badges
10
This might plausibly explain why the destination port would be 993/tcp, but in OP's case, it's the source port. The destination port is 47920/tcp.
– a CVn
Jul 17 at 22:19
6
@aCVn Which suggests that the OP might be connecting to Google, instead of the other way around...
– marcelm
Jul 17 at 23:12
4
@marcelm That is indeed the case, as indicated by theACK SYNflags on the first packet in the list. I've posted a more detailed explanation as an answer.
– David
Jul 17 at 23:31
1
@marcelm Maybe there is malware on the server attempting to send spam via gmail somehow.
– Qwertie
Jul 18 at 7:17
2
@Qwertie: Most malware sending spam would go for SMTP ports (25/465/587) and wouldn't bother with IMAP.
– grawity
Jul 18 at 13:20
add a comment
|
Port 993 is for encrypted IMAP traffic.
Gmail has a feature where it can check external IMAP servers and bring those emails into your inbox.
As such, I suspect your IP address was previously that of someone's email server, and they configured Gmail to check that server for their emails. (Alternatively, but less likely, that "someone" is you, and you forgot you did this.)
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
answered Jul 17 at 14:03
ceejayozceejayoz
28.3k6 gold badges70 silver badges97 bronze badges
10
This might plausibly explain why the destination port would be 993/tcp, but in OP's case, it's the source port. The destination port is 47920/tcp.
– a CVn
Jul 17 at 22:19
6
@aCVn Which suggests that the OP might be connecting to Google, instead of the other way around...
– marcelm
Jul 17 at 23:12
4
@marcelm That is indeed the case, as indicated by theACK SYNflags on the first packet in the list. I've posted a more detailed explanation as an answer.
– David
Jul 17 at 23:31
1
@marcelm Maybe there is malware on the server attempting to send spam via gmail somehow.
– Qwertie
Jul 18 at 7:17
2
@Qwertie: Most malware sending spam would go for SMTP ports (25/465/587) and wouldn't bother with IMAP.
– grawity
Jul 18 at 13:20
add a comment
|
Port 993 is for encrypted IMAP traffic.
Gmail has a feature where it can check external IMAP servers and bring those emails into your inbox.
As such, I suspect your IP address was previously that of someone's email server, and they configured Gmail to check that server for their emails. (Alternatively, but less likely, that "someone" is you, and you forgot you did this.)
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
answered Jul 17 at 14:03
ceejayozceejayoz
28.3k6 gold badges70 silver badges97 bronze badges
Port 993 is for encrypted IMAP traffic.
Gmail has a feature where it can check external IMAP servers and bring those emails into your inbox.
As such, I suspect your IP address was previously that of someone's email server, and they configured Gmail to check that server for their emails. (Alternatively, but less likely, that "someone" is you, and you forgot you did this.)
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
answered Jul 17 at 14:03
ceejayozceejayoz
28.3k6 gold badges70 silver badges97 bronze badges
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
edited Jul 21 at 22:52
Peter Mortensen
2,1765 gold badges22 silver badges24 bronze badges
2,1765 gold badges22 silver badges24 bronze badges
answered Jul 17 at 14:03
ceejayozceejayoz
28.3k6 gold badges70 silver badges97 bronze badges
answered Jul 17 at 14:03
ceejayozceejayoz
28.3k6 gold badges70 silver badges97 bronze badges
answered Jul 17 at 14:03
ceejayozceejayoz
28.3k6 gold badges70 silver badges97 bronze badges
28.3k6 gold badges70 silver badges97 bronze badges
10
This might plausibly explain why the destination port would be 993/tcp, but in OP's case, it's the source port. The destination port is 47920/tcp.
– a CVn
Jul 17 at 22:19
6
@aCVn Which suggests that the OP might be connecting to Google, instead of the other way around...
– marcelm
Jul 17 at 23:12
4
@marcelm That is indeed the case, as indicated by theACK SYNflags on the first packet in the list. I've posted a more detailed explanation as an answer.
– David
Jul 17 at 23:31
1
@marcelm Maybe there is malware on the server attempting to send spam via gmail somehow.
– Qwertie
Jul 18 at 7:17
2
@Qwertie: Most malware sending spam would go for SMTP ports (25/465/587) and wouldn't bother with IMAP.
– grawity
Jul 18 at 13:20
add a comment
|
10
This might plausibly explain why the destination port would be 993/tcp, but in OP's case, it's the source port. The destination port is 47920/tcp.
– a CVn
Jul 17 at 22:19
6
@aCVn Which suggests that the OP might be connecting to Google, instead of the other way around...
– marcelm
Jul 17 at 23:12
4
@marcelm That is indeed the case, as indicated by theACK SYNflags on the first packet in the list. I've posted a more detailed explanation as an answer.
– David
Jul 17 at 23:31
1
@marcelm Maybe there is malware on the server attempting to send spam via gmail somehow.
– Qwertie
Jul 18 at 7:17
2
@Qwertie: Most malware sending spam would go for SMTP ports (25/465/587) and wouldn't bother with IMAP.
– grawity
Jul 18 at 13:20
10
10
This might plausibly explain why the destination port would be 993/tcp, but in OP's case, it's the source port. The destination port is 47920/tcp.
– a CVn
Jul 17 at 22:19
This might plausibly explain why the destination port would be 993/tcp, but in OP's case, it's the source port. The destination port is 47920/tcp.
– a CVn
Jul 17 at 22:19
6
6
@aCVn Which suggests that the OP might be connecting to Google, instead of the other way around...
– marcelm
Jul 17 at 23:12
@aCVn Which suggests that the OP might be connecting to Google, instead of the other way around...
– marcelm
Jul 17 at 23:12
4
4
@marcelm That is indeed the case, as indicated by the
ACK SYN flags on the first packet in the list. I've posted a more detailed explanation as an answer.– David
Jul 17 at 23:31
@marcelm That is indeed the case, as indicated by the
ACK SYN flags on the first packet in the list. I've posted a more detailed explanation as an answer.– David
Jul 17 at 23:31
1
1
@marcelm Maybe there is malware on the server attempting to send spam via gmail somehow.
– Qwertie
Jul 18 at 7:17
@marcelm Maybe there is malware on the server attempting to send spam via gmail somehow.
– Qwertie
Jul 18 at 7:17
2
2
@Qwertie: Most malware sending spam would go for SMTP ports (25/465/587) and wouldn't bother with IMAP.
– grawity
Jul 18 at 13:20
@Qwertie: Most malware sending spam would go for SMTP ports (25/465/587) and wouldn't bother with IMAP.
– grawity
Jul 18 at 13:20
add a comment
|
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f975594%2fwhy-is-google-approaching-my-vps-machine%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
