Inbound traffic on source port 80

I haven't checked my firewall logs in awhile, so I decided to do a very quick assessment.

I immediately noticed a pattern of inbound hosts attempting to communicate on source port 80, which is weird, as that's not typically a normal port for non-webservers to communicate on.  Web clients typically communicate on destination port 80 unless it's the web server responding to a previous HTTP request (to a client).  That's not the case here.  These connection attempts are being initiated at source port, by IPs not normally affiliated with my server.

Here's an example:

Jul  2 08:40:18 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=92.53.126.193 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=53 ID=21826 PROTO=TCP SPT=80 DPT=64689 WINDOW=16384 RES=0x00 ACK SYN URGP=0
Jul  2 11:15:50 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=77.241.198.20 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=115 ID=30264 DF PROTO=TCP SPT=80 DPT=8713 WINDOW=8192 RES=0x00 ACK SYN URGP=0
Jul  2 11:15:53 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=77.241.198.20 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=115 ID=323 DF PROTO=TCP SPT=80 DPT=8713 WINDOW=8192 RES=0x00 ACK SYN URGP=0
Jul  2 12:17:20 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=172.245.4.168 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=80 DPT=5359 WINDOW=5840 RES=0x00 ACK SYN URGP=0
Jul  2 14:37:01 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=94.23.170.2 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=52 ID=36510 PROTO=TCP SPT=80 DPT=26429 WINDOW=16384 RES=0x00 ACK SYN URGP=0
Jul  2 14:39:33 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=91.121.9.198 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=52 ID=43029 PROTO=TCP SPT=80 DPT=30638 WINDOW=16384 RES=0x00 ACK SYN URGP=0
Jul  2 15:02:45 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=213.186.33.5 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=236 ID=35986 PROTO=TCP SPT=80 DPT=11082 WINDOW=536 RES=0x00 ACK SYN URGP=0
Jul  2 17:02:10 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=91.105.235.7 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=40217 WINDOW=14600 RES=0x00 ACK SYN URGP=0
Jul  2 17:02:10 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=91.105.235.7 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=40217 WINDOW=14600 RES=0x00 ACK SYN URGP=0
Jul  2 17:53:52 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=142.4.208.23 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=80 DPT=31415 WINDOW=14600 RES=0x00 ACK SYN URGP=0
Jul  2 18:15:55 li7-220 kernel: Clean-up Rule - BLOCKED: IN=eth0 OUT= MAC=fe:fd:40:3e:e7:dc:84:78:ac:0d:79:c1:08:00 SRC=199.101.102.66 DST=abc.def.ghi.klm LEN=44 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=80 DPT=23103 WINDOW=14600 RES=0x00 ACK SYN URGP=0

Almost half of the logged traffic is trying to communicate on source port 80 (of 486 log entries, 218 are source port 80).  The traffic is being blocked by the firewall, and what I'm seeing is initiation attempts.  This traffic isn't a huge issue, but I'm curious as to what's going on.  I've commented on such traffic before, but the amount I'm seeing now is far more than what I'm used to seeing.

I think I'll capture some traffic to try to see what's going on.

EDIT:  nothing much captured so far.  After some sniffing and tinkering, I had to filter some IPs out - two IPs belong to my server and the other belongs to Ubuntu):

root@li7-220:~# tcpdump -XXvvnne -s 0 -r pcap.linode.src_port_80_2 | less
reading from file pcap.linode.src_port_80_2, link-type EN10MB (Ethernet)
20:56:43.532338 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 112, id 3943, offset 0, flags [none], proto TCP (6), length 44)
    190.220.25.34.80 > abc.def.ghi.klm 1234: Flags [S.], cksum 0x36e9 (correct), seq 2466963778, ack 1, win 16384, options [mss 1460], length 0
        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.
        0x0010:  002c 0f67 0000 7006 93a8 bedc 1922 42a0  .,.g..p......"B.
        0x0020:  8d1e 0050 04d2 930a e142 0000 0001 6012  ...P.....B....`.
        0x0030:  4000 36e9 0000 0204 05b4 0000            @.6.........

UPDATE:  I let a pcap capture run overnight and when I checked the process, I got 999 hits.  In looking at the pcap, I saw that I'd missed a few Ubuntu server IPs that my sercer was polling (for OS updates).  I filtered those out and got 22 hits:


21:29:53.200175 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 53, id 0, offset 0, flags [DF], proto TCP (6), length 44)
    206.188.198.69.80 > abc.def.ghi.jkl.31029: Flags [S.], cksum 0x6868 (correct), seq 2068810236, ack 320012289, win 14600, options [mss 1460], length 0
        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.
        0x0010:  002c 0000 4000 3506 e10b cebc c645 42a0  .,..@.5......EB.
        0x0020:  8d1e 0050 7935 7b4f 89fc 1313 0001 6012  ...Py5{O......`.
        0x0030:  3908 6868 0000 0204 05b4 4001            9.hh......@.
23:44:52.151134 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 50, id 0, offset 0, flags [DF], proto TCP (6), length 44)
    109.236.85.70.80 > abc.def.ghi.jkl.15190: Flags [S.], cksum 0x0d4e (correct), seq 3480870608, ack 3571253249, win 14600, options [mss 1460], length 0
        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.
        0x0010:  002c 0000 4000 3206 b5db 6dec 5546 42a0  .,..@.2...m.UFB.
        0x0020:  8d1e 0050 3b56 cf79 ded0 d4dd 0001 6012  ...P;V.y......`.
        0x0030:  3908 0d4e 0000 0204 05b4 0000            9..N........
23:59:19.278658 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 57, id 3552, offset 0, flags [none], proto TCP (6), length 44)
    168.61.144.13.80 > abc.def.ghi.jkl.56871: Flags [S.], cksum 0xeacd (correct), seq 280591713, ack 4171956225, win 16384, options [mss 1460], length 0
        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.
        0x0010:  002c 0de0 0000 3906 6be3 a83d 900d 42a0  .,....9.k..=..B.
        0x0020:  8d1e 0050 de27 10b9 7d61 f8ab 0001 6012  ...P.'..}a....`.
        0x0030:  4000 eacd 0000 0204 05b4 0000            @...........
01:51:58.488229 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 55, id 0, offset 0, flags [DF], proto TCP (6), length 44)
    84.16.89.109.80 > abc.def.ghi.jkl.25420: Flags [S.], cksum 0x1559 (correct), seq 1800765718, ack 3394417182, win 14600, options [mss 1460], length 0
        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.
        0x0010:  002c 0000 4000 3706 c690 5410 596d 42a0  .,..@.7...T.YmB.
        0x0020:  8d1e 0050 634c 6b55 8116 ca52 b21e 6012  ...PcLkU...R..`.
        0x0030:  3908 1559 0000 0204 05b4 0000            9..Y........
03:57:00.885857 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 118, id 7812, offset 0, flags [DF], proto TCP (6), length 44)
    188.138.86.58.80 > abc.def.ghi.jkl.3456: Flags [S.], cksum 0xec7d (correct), seq 689800127, ack 2517303297, win 8192, options [mss 1460], length 0
        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.
        0x0010:  002c 1e84 4000 7606 ab68 bc8a 563a 403e  .,..@.v..h..V:@>
        0x0020:  e7dc 0050 0d80 291d 83bf 960b 0001 6012  ...P..).......`.
        0x0030:  2000 ec7d 0000 0204 05b4 0000            ...}........
07:56:45.059391 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 244, id 31356, offset 0, flags [none], proto TCP (6), length 40)
    164.177.186.182.80 > abc.def.ghi.jkl.24548: Flags [R.], cksum 0x2305 (correct), seq 1331337029, ack 1, win 5840, length 0
        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.
        0x0010:  0028 7a7c 0000 f406 1d2d a4b1 bab6 42a0  .(z|.....-....B.
        0x0020:  8d1e 0050 5fe4 4f5a 9745 0000 0001 5014  ...P_.OZ.E....P.
        0x0030:  16d0 2305 0000 0000 0000 0000            ..#.........
08:29:11.344433 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 234, id 38305, offset 0, flags [none], proto TCP (6), length 40)
    222.231.1.55.80 > abc.def.ghi.jkl.1234: Flags [S.], cksum 0xd717 (correct), seq 3438077857, ack 1, win 5840, length 0
        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.
        0x0010:  0028 95a1 0000 ea06 32f5 dee7 0137 403e  .(......2....7@>
        0x0020:  e7dc 0050 04d2 ccec e7a1 0000 0001 5012  ...P..........P.
        0x0030:  16d0 d717 0000 0000 0000 0000            ............

08:47:53.958682 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 221, id 14963, offset 0, flags [none], proto TCP (6), length 40)

    222.231.1.55.80 > abc.def.ghi.jkl.1234: Flags [S.], cksum 0xf320 (correct), seq 2967725985, ack 1, win 5840, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 3a73 0000 dd06 9b23 dee7 0137 403e  .(:s.....#...7@>

        0x0020:  e7dc 0050 04d2 b0e3 e7a1 0000 0001 5012  ...P..........P.

        0x0030:  16d0 f320 0000 0000 0000 0000            ............

09:08:53.303546 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 62: (tos 0x0, ttl 116, id 26734, offset 0, flags [none], proto TCP (6), length 48)

    66.161.44.199.80 > abc.def.ghi.jkl.61773: Flags [S.], cksum 0x0776 (correct), seq 3759141565, ack 2231612163, win 16384, options [mss 1460,nop,nop,sackOK], length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0030 686e 0000 7406 9f33 42a1 2cc7 42a0  .0hn..t..3B.,.B.

        0x0020:  8d1e 0050 f14d e00f f2bd 8503 b303 7012  ...P.M........p.

        0x0030:  4000 0776 0000 0204 05b4 0101 0402       @..v..........

11:57:44.978045 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0x2882 (correct), seq 2018622826, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 8c11 df04 759f 403e  .(..@.r.....u.@>

        0x0020:  e7dc 0050 d484 7851 bd6a 0000 0001 5012  ...P..xQ.j....P.

        0x0030:  0000 2882 0000 aaaa 0000 2882            ..(.......(.

11:59:10.842293 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.41266: Flags [S.], cksum 0xa070 (correct), seq 2354167082, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 e46d df04 759f 42a0  .(..@.r..m..u.B.

        0x0020:  8d1e 0050 a132 8c51 bd2a 0000 0001 5012  ...P.2.Q.*....P.

        0x0030:  0000 a070 0000 aaaa 0000 a070            ...p.......p

12:02:08.880498 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x2,ECT(0), ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0x28c2 (correct), seq 2018622762, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4502  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 8c0f df04 759f 403e  .(..@.r.....u.@>

        0x0020:  e7dc 0050 d484 7851 bd2a 0000 0001 5012  ...P..xQ.*....P.

        0x0030:  0000 28c2 0000 aaaa 0000 28c2            ..(.......(.

12:53:54.286082 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0x2594 (correct), seq 2067774826, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 8c11 df04 759f 403e  .(..@.r.....u.@>

        0x0020:  e7dc 0050 d484 7b3f bd6a 0000 0001 5012  ...P..{?.j....P.

        0x0030:  0000 2594 0000 aaaa 0000 2594            ..%.......%.

12:55:19.762030 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.41266: Flags [S.], cksum 0x5cec (correct), seq 3486891306, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 e46d df04 759f 42a0  .(..@.r..m..u.B.

        0x0020:  8d1e 0050 a132 cfd5 bd2a 0000 0001 5012  ...P.2...*....P.

        0x0030:  0000 5cec 0000 aaaa 0000 5cec            ..\.......\.

13:00:54.393330 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0xa4fd (correct), seq 4225088874, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 8c11 df04 759f 403e  .(..@.r.....u.@>

        0x0020:  e7dc 0050 d484 fbd5 bd6a 0000 0001 5012  ...P.....j....P.

        0x0030:  0000 a4fd 0000 aaaa 0000 a4fd            ............

13:05:42.419546 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 240, id 18537, offset 0, flags [none], proto TCP (6), length 40)

    195.244.222.208.80 > abc.def.ghi.jkl.3409: Flags [S.], cksum 0xa210 (correct), seq 302051360, ack 857669633, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 4869 0000 f006 b786 c3f4 ded0 403e  .(Hi..........@>

        0x0020:  e7dc 0050 0d51 1200 f020 331f 0001 5012  ...P.Q....3...P.

        0x0030:  0000 a210 0000 0000 0000 0000            ............

13:16:03.791551 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 52, id 16141, offset 0, flags [none], proto TCP (6), length 44)

    94.23.225.114.80 > abc.def.ghi.jkl.24664: Flags [S.], cksum 0x369d (correct), seq 323364370, ack 533921793, win 16384, options [mss 1460], length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  002c 3f0d 0000 3406 e01a 5e17 e172 403e  .,?...4...^..r@>

        0x0020:  e7dc 0050 6058 1346 2612 1fd3 0001 6012  ...P`X.F&.....`.

        0x0030:  4000 369d 0000 0204 05b4 2626            @.6.......&&

13:26:19.398167 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 116, id 33033, offset 0, flags [none], proto TCP (6), length 40)

    121.10.105.5.80 > abc.def.ghi.jkl.1234: Flags [.], cksum 0x1c3f (correct), seq 2951871426, ack 788062144, win 8760, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 8109 0000 7406 13f9 790a 6905 42a0  .(....t...y.i.B.

        0x0020:  8d1e 0050 04d2 aff1 fbc2 2ef8 dfc0 5010  ...P..........P.

        0x0030:  2238 1c3f 0000 aaaa 2238 1c3f            "8.?...."8.?

13:35:52.715311 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0xa2a5 (correct), seq 4264410474, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 8c11 df04 759f 403e  .(..@.r.....u.@>

        0x0020:  e7dc 0050 d484 fe2d bd6a 0000 0001 5012  ...P...-.j....P.

        0x0030:  0000 a2a5 0000 aaaa 0000 a2a5            ............

13:37:20.082116 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.41266: Flags [S.], cksum 0x2295 (correct), seq 170769706, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 e46d df04 759f 42a0  .(..@.r..m..u.B.

        0x0020:  8d1e 0050 a132 0a2d bd2a 0000 0001 5012  ...P.2.-.*....P.

        0x0030:  0000 2295 0000 aaaa 0000 2295            ..".......".

14:03:05.415420 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 55, id 9949, offset 0, flags [none], proto TCP (6), length 44)

    69.20.56.19.80 > abc.def.ghi.jkl.48972: Flags [S.], cksum 0x1c7d (correct), seq 1191661700, ack 1191661700, win 16384, options [mss 1460], length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  002c 26dd 0000 3706 100a 4514 3813 42a0  .,&...7...E.8.B.

        0x0020:  8d1e 0050 bf4c 4707 5084 4707 5084 6012  ...P.LG.P.G.P.`.

        0x0030:  4000 1c7d 0000 0204 05b4 0000            @..}........

14:35:45.494119 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 232, id 40546, offset 0, flags [none], proto TCP (6), length 40)

    222.231.1.199.80 > abc.def.ghi.jkl.1234: Flags [S.], cksum 0xaea0 (correct), seq 1770244942, ack 1, win 5840, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 9e62 0000 e806 8400 dee7 01c7 42a0  .(.b..........B.

        0x0020:  8d1e 0050 04d2 6983 cb4e 0000 0001 5012  ...P..i..N....P.

        0x0030:  16d0 aea0 0000 0000 0000 0000            ............

Each are SYN packets...the firewall is blocking any further activity (at the catch-all/deny-all rule).

I did notice a pattern, though:

root@li7-220:~# cat test3.txt | grep "1234"

    222.231.1.55.80 > abc.def.ghi.jkl.1234: Flags [S.], cksum 0xd717 (correct), seq 3438077857, ack 1, win 5840, length 0

    222.231.1.55.80 > abc.def.ghi.jkl.1234: Flags [S.], cksum 0xf320 (correct), seq 2967725985, ack 1, win 5840, length 0

    121.10.105.5.80 > abc.def.ghi.jkl.1234: Flags [.], cksum 0x1c3f (correct), seq 2951871426, ack 788062144, win 8760, length 0

    222.231.1.199.80 > abc.def.ghi.jkl.1234: Flags [S.], cksum 0xaea0 (correct), seq 1770244942, ack 1, win 5840, length 0

root@li7-220:~# cat test3.txt | grep "41266"

    223.4.117.159.80 > abc.def.ghi.jkl.41266: Flags [S.], cksum 0xa070 (correct), seq 2354167082, ack 1, win 0, length 0

    223.4.117.159.80 > abc.def.ghi.jkl.41266: Flags [S.], cksum 0x5cec (correct), seq 3486891306, ack 1, win 0, length 0

    223.4.117.159.80 > abc.def.ghi.jkl.41266: Flags [S.], cksum 0x2295 (correct), seq 170769706, ack 1, win 0, length 0

root@li7-220:~# cat test3.txt | grep "54404"

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0x2882 (correct), seq 2018622826, ack 1, win 0, length 0

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0x28c2 (correct), seq 2018622762, ack 1, win 0, length 0

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0x2594 (correct), seq 2067774826, ack 1, win 0, length 0

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0xa4fd (correct), seq 4225088874, ack 1, win 0, length 0

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0xa2a5 (correct), seq 4264410474, ack 1, win 0, length 0

As well, in the below instances, the source host is the same.  The packets are maybe 2 min apart (this is a sequential set of packets).  The destination ports are different:

13:35:52.715311 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.54404: Flags [S.], cksum 0xa2a5 (correct), seq 4264410474, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 8c11 df04 759f 403e  .(..@.r.....u.@>

        0x0020:  e7dc 0050 d484 fe2d bd6a 0000 0001 5012  ...P...-.j....P.

        0x0030:  0000 a2a5 0000 aaaa 0000 a2a5            ............

13:37:20.082116 84:78:ac:0d:79:c1 > fe:fd:40:3e:e7:dc, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 114, id 0, offset 0, flags [DF], proto TCP (6), length 40)

    223.4.117.159.80 > abc.def.ghi.jkl.41266: Flags [S.], cksum 0x2295 (correct), seq 170769706, ack 1, win 0, length 0

        0x0000:  fefd 403e e7dc 8478 ac0d 79c1 0800 4500  ..@>...x..y...E.

        0x0010:  0028 0000 4000 7206 e46d df04 759f 42a0  .(..@.r..m..u.B.

        0x0020:  8d1e 0050 a132 0a2d bd2a 0000 0001 5012  ...P.2.-.*....P.

        0x0030:  0000 2295 0000 aaaa 0000 2295            ..".......".

Someone is scanning my server and purposely using source port 80 when attempting deliberate (and distributed) scans.  If I had the balls to run a honeypot, I could probably gain a better understanding of what type of scans are being conducted.

My Book Live - Connection Issues and Troubleshooting

I've been noticing issues with my NAS solution, which is a Western Digital My Book Live Personal Cloud Edition.

I keep losing connectivity after 5 or so minutes of connecting to the NAS via the web-based console or accessing it as a mapped drive.  I'd get the message:

30001 - Your last operation timed out. Make sure there are no network connectivity issues and try again.

I used Google to attempt to find a solution, but all I see is shared pain.

I did find a way to log into the device's command line.  Here's what I did:

• I put "http://[ip of your MBL NAS]/UI/ssh" into my browser's address bar.
• Clicked the "enable" button.
• Shelled into the NAS using Putty and "root/welc0me" as a username/password.

Once I logged in, I immediately began to run 'top' because I knew I'd lose the session after 5 or so minutes and wouldn't be able to log in again unless I power-cycled the NAS.  I noticed that Twonky appeared to hog CPU cycles, so I went to the web GUI and disabled it.  Then I watched top again.  The load averages were a bit high before I disabled Twonky (in the 7.xx range as a first number).  I watched them drop to the mid-4s, then they started raising again.  Top wasn't telling me anything, though.

I watched the load average raise to 22.xx before the terminal session showed signs of degrading to the point that it stopped taking input.

login as: root

root@xxx.xxx.xxx.xxx's password:

Linux MyBookLive 2.6.32.11-svn70860 #1 Thu May 17 13:32:51 PDT 2012 ppc

Disclaimer: SSH provides access to the network device and all its

content, only users with advanced computer networking and Linux experience

should enable it. Failure to understand the Linux command line interface

can result in rendering your network device inoperable, as well as allowing

unauthorized users access to your network. If you enable SSH, do not share

the root password with anyone you do not want to have direct access to all

the content on your network device.

MyBookLive:~# w

 22:37:58 up 2 min,  1 user,  load average: 5.03, 1.54, 0.54

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    1.00s  0.05s  0.03s w

MyBookLive:~# w

 22:38:10 up 2 min,  1 user,  load average: 5.85, 1.89, 0.67

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.04s  0.02s w

MyBookLive:~# w

 22:38:18 up 2 min,  1 user,  load average: 6.11, 2.07, 0.74

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.04s  0.02s w

MyBookLive:~#

MyBookLive:~#

MyBookLive:~#

MyBookLive:~# top

top - 22:39:10 up 3 min,  1 user,  load average: 7.44, 3.06, 1.14

Tasks:  97 total,   1 running,  96 sleeping,   0 stopped,   0 zombie

Cpu(s): 31.9%us, 17.4%sy, 41.8%ni,  0.0%id,  6.6%wa,  0.3%hi,  2.0%si,  0.0%st

Mem:    253632k total,   242432k used,    11200k free,    41280k buffers

Swap:   500608k total,    42560k used,   458048k free,    52736k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND

 4429 root      21   1 21504 8192 3456 S 43.6  3.2   0:45.39 twonkymediaserv

 3936 www-data   4 -16 72704  30m  20m S 11.6 12.4   0:01.09 apache2

 3327 www-data   4 -16 76160  31m  19m S  5.6 12.6   0:02.37 apache2

 3809 www-data   4 -16 72704  33m  23m S  5.6 13.6   0:03.08 apache2

 3326 www-data   4 -16 74944  26m  16m S  1.7 10.7   0:03.34 apache2

 3829 www-data   4 -16 66624  23m  16m S  1.3  9.7   0:01.50 apache2

 4156 www-data   4 -16 69248  25m  17m S  1.3 10.3   0:00.30 apache2

 5071 root       4 -16  5056 3136 2304 D  1.0  1.2   0:00.03 getServiceStart

 4639 root      39  19  5120 3264 1920 D  0.7  1.3   0:03.12 ls

 4641 root      39  19  3776 1792 1344 S  0.7  0.7   0:00.77 tally

 4821 root      20   0  5056 3008 1920 R  0.7  1.2   0:00.34 top

 5067 root       4 -16  5056 3136 2304 D  0.7  1.2   0:00.02 getServiceStart

 2230 root      20   0 31424 3264 2048 S  0.3  1.3   0:00.19 rsyslogd

 2385 root      20   0     0    0    0 D  0.3  0.0   0:00.28 jbd2/sda4-8

 4405 root      20   0 57280 7552 2816 S  0.3  3.0   0:00.94 forked-daapd

 4640 root      39  19  4480 1856 1344 S  0.3  0.7   0:00.48 awk

    1 root      20   0  4352 1984 1600 S  0.0  0.8   0:00.82 init

MyBookLive:~#

MyBookLive:~#

MyBookLive:~#

MyBookLive:~# w

 22:39:15 up 3 min,  1 user,  load average: 7.24, 3.09, 1.16

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    1.00s  0.04s  0.02s w

MyBookLive:~# w

 22:39:16 up 3 min,  1 user,  load average: 7.24, 3.09, 1.16

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.03s  0.01s w

MyBookLive:~# w

 22:39:19 up 3 min,  1 user,  load average: 7.22, 3.16, 1.20

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    1.00s  0.04s  0.02s w

MyBookLive:~# w

 22:39:20 up 3 min,  1 user,  load average: 7.22, 3.16, 1.20

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.03s  0.01s w

MyBookLive:~# w

 22:39:25 up 3 min,  1 user,  load average: 7.36, 3.25, 1.24

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    2.00s  0.04s  0.02s w

MyBookLive:~# w

 22:39:32 up 3 min,  1 user,  load average: 7.09, 3.26, 1.25

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.05s  0.02s w

MyBookLive:~# w

 22:39:39 up 3 min,  1 user,  load average: 6.62, 3.29, 1.28

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.04s  0.01s w

MyBookLive:~# w

 22:40:17 up 4 min,  1 user,  load average: 5.75, 3.43, 1.40

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    1.00s  0.05s  0.02s w

MyBookLive:~# w

 22:40:24 up 4 min,  1 user,  load average: 5.79, 3.52, 1.45

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.05s  0.02s w

MyBookLive:~# w

 22:40:35 up 4 min,  1 user,  load average: 6.11, 3.66, 1.52

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    1.00s  0.05s  0.01s w

MyBookLive:~# w

 22:40:46 up 4 min,  1 user,  load average: 5.85, 3.69, 1.55

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.05s  0.01s w

MyBookLive:~# w

 22:41:00 up 5 min,  1 user,  load average: 5.44, 3.70, 1.59

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.05s  0.01s w

MyBookLive:~# w

 22:41:54 up 5 min,  2 users,  load average: 4.65, 3.75, 1.73

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    0.00s  0.06s  0.02s w

root     pts/1    ron-alien.home   22:41   21.00s  0.17s  0.15s top

MyBookLive:~# w

 22:42:48 up 6 min,  2 users,  load average: 4.90, 3.93, 1.89

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    2.00s  0.09s  0.04s w

root     pts/1    ron-alien.home   22:41    1:15   0.50s  0.48s top

MyBookLive:~#

MyBookLive:~#

MyBookLive:~# w

 22:43:11 up 7 min,  2 users,  load average: 5.26, 4.09, 1.99

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    ron-alien.home   22:37    2.00s  0.07s  0.02s w

root     pts/1    ron-alien.home   22:41    1:39   0.66s  0.64s top

MyBookLive:~# w

Then there is this:

Something isn't quite right with this NAS, but it's going to take awhile to figure out what's going on.  Also, it responds well to pings, even if the SSH session is dead and won't recover.  And I still have to back it up.  I think I've 378GB of data on it (that's crucial...like once-in-a-lifetime types of pictures).

I don't think the drives are bad, but it may be too early to say that.  I've never seen bad drives ramp up load averages like that.

The drive is out of warranty and I'm a bit upset that what's touted as a top-notch home NAS is having such issues, especially considering that it's a WD product.

I'll update this post when/if I've more findings on this issue.

EDIT:  I just checked again after posting and, while the shells aren't dead, they are very slide-show-like.  I checked the load average and it's dropped to 12.94.

EDIT 2:  I got tired of waiting for "apachectl stop" to finish and I think it was actually hung, so I did a "killall -9 apache2" which immediately brought the load down.  The load is currently at 1.09 and has been around that the last 20 minutes.  So, it's apache that's killing the NAS.  Note that I tested to see if I could reach the NAS shares in a conventional manner (ie, non-shell or without apache) and was able to reach the shares without issue.  I may keep apache off for the duration (unless I need to access the control panel).