Ad Widget

Collapse

Strange client-originated traffic on random ports

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • dandelionwine
    Junior Member
    • Aug 2017
    • 1
    #1

    Strange client-originated traffic on random ports

    I have a Zabbix server and a Zabbix agent. They're working fine - but I noticed the agent is sending strange traffic that is being blocked by the firewall. It sends a packet every few seconds that look like:

    Code:
    Aug 25 23:51:12 hostname kernel: Shorewall:net-fw:DROP:IN=eno1 OUT= MAC=xxx SRC=97.a.b.c DST=192.168.a.b LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=27541 DF PROTO=TCP SPT=10050 DPT=36972 WINDOW=0 RES=0x00 RST URGP=0
Aug 25 23:51:13 hostname kernel: Shorewall:net-fw:DROP:IN=eno1 OUT= MAC=xxx SRC=97.a.b.c DST=192.168.a.b LEN=40 TOS=0x00 PREC=0x00 TTL=55 ID=27581 DF PROTO=TCP SPT=10050 DPT=36984 WINDOW=0 RES=0x00 RST URGP=0
    My server has a 192.168.a.b local IP from my ISP, but they put me in a DMZ so any incoming connection to the external IP I appear from comes to me. That external ip is 76.a.b.c. My agent is at 97.a.b.c.

    My server config (no comments, only relevent parameters):

    Code:
    ListenPort=10051
    My agent config (no comments, only relevent parameters):

    Code:
    Server=76.a.b.c,127.0.0.1
ListenIP=0.0.0.0
ServerActive=76.a.b.c
    My host config in the Zabbix admin panel:

    Code:
    IP address is 97.a.b.c with port 10050
Connections to Host: Certificate
Connections from host: PSK & Certificate
All boxes are green (Cert; PSK, Cert)
    As I said - everything works. But why is my zabbix agent trying to talk to my zabbix server with a _source_ port of 10050 and a random destination port over TCP?
    Tags: None
    • NTMMFTS
      Junior Member
      • Jul 2018
      • 1
      #2
      I'm having this same exact issue in v4.4 on debian 10 (buster) and haven't found a solution. I'm using the ufw firewall on the server and it blocks about 100 of these connection attempts per hour on random ports from five different debian hosts so I ended up disabling firewall logging until I figure it out. Did you figure out what was causing this? Thnx, ntmmfts.

        Comment

        • dieselfluxcapacitor
          Junior Member
          • Jul 2023
          • 11
          #3
          Were you ever able to come up with a solution to this? I am seeing the same thing on Zabbix Server 6.4 running on Ubuntu 20.04 LTS.

          I tried adding a UFW rule to allow the traffic based on the source port, but that didn't work.
          Code:
          sudo ufw allow proto tcp from 1.1.1.1 port 10050 to any

            Comment

            Previous template Next
            Working...