Unexpected Outbound SSH traffic

Jun 09, 2006 4 Replies

Rate this thread:

putterflutters 20 years ago

I was using Logviewer to watch my Linksys firewall/router block all the incoming traffic and feeling good when I noticed:

Direction Type Local IP Local Port Remote IP Remote Port Action Outbound TCP 192.168.1.11 22 (ssh) 218.55.23.50 39606 Permit Outbound TCP 192.168.1.11 22 (ssh) 218.75.129.242 52685 Permit Outbound TCP 192.168.1.11 22 (ssh) 222.122.56.141 41805 Permit Outbound TCP 192.168.1.11 22 (ssh) 211.167.89.99 40025 Permit

These connections seem destined to nearly the same places that I have been knocking at my door inbound and been blocked.

Is there or was there anything bad happening locally that I should worry about or am I just pariaoid?

Ran virsus checks and spyware checks ...nothing suspicious there....

I have hopefully shut off port 22 outbound and getting by so far.

Thanks, Putter

Vote

Lars M. Hansen 20 years ago

On 9 Jun 2006 13:37:28 -0700, snipped-for-privacy@gmail.com spoketh

Is 192.168.1.11 your computer? What OS is it running? Is there any reason why it should make outbound connections on any port? Have you tried using a program such a TCPView from sysinternals.com to see what program/process (assumes Windows) are making the connection attempt?

Lars M. Hansen

formatting link

'badnews' with 'news' in e-mail address)

Vote

Duane Arnold 20 years ago

I see you're still alive and kicking.

Duane :)

Vote

Putter 20 years ago

Howdy Lars and thanks!

Yup..... 192.168.1.11 is my local machine running WinXP with all the updates. I think I can attribute most of the outbound connections to processes I know about. (Some things like the IM programs seem to like to make their own connections to advertise ... toolbars like Google do their own thing too).

Now that I think about it ... way back when ... my daughter used this machine and did the usual teenage things. I thought I had cleaned up what she had done after she left for school but I am wondering there something I missed which is still lurking in the background.

I have only used the windows task manager to try and ID what is running...mostly benign stuff if you believe

formatting link

Thanks for the lead on TCPView I will see what I can do with that. I am barely literate when it comes to such things but I can usually bungle my way through.

Just seems wierd that my machine is trying to have its own international relationships ... :-\\ can't be a good thing.

Thanks again, Norm

Vote

Lars M. Hansen 20 years ago

On Sat, 10 Jun 2006 01:35:55 GMT, Duane Arnold

Yeah, I took an extended hiatus from usenet. I'll peek in from time to time and see how the battle goes.

Lars M. Hansen

formatting link

'badnews' with 'news' in e-mail address)

Vote

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required