Zabbix Agent2 opens hundreds of high-ports to my zabbix server

[gunnarson]

Hi guys,

my zabbix agent2 (attempt) opens hundreds of high-ports to my zabbix server host (please look at the attachment). I noticed it with sysinternals tool tcpview.exe.

My test envoroment:
- Zabbix appliance v7.2.7 (default installation with default config ...)
- Zabbix agent2 v7.2.6 on Windows Server 2019

Does anyone have an idea why the agent is doing something like this? The passive agent communication is fine and zabbix server show my a lot of informations about my Windows Server. Did I misconfigure something (this is my first attempt with Zabbix)?

Many greetings and thanks a lot for any help,
Gunnarson

[MRedbourne]

This is quite normal in traditional networking. I'm assuming this is a passive zabbix agent?

2 Passive and active agent checks

For example, for supported items:

1. Server opens a TCP connection

Every time the Zabbix server requests an item from the Zabbix agent, it opens a new TCP in the ephemeral port range. Most applications do this that operate in the TCP/IP stack, including your web browser when accessing things like the zabbix web forums.


104.26.6.148 is the Zabbix webforum for example. Note that my host machine (192.168.1.112) is connecting from a high port to port 443 on the web server. Zabbix will automatically open the number of connections it needs in order to have that amount of data flow, up to whatever is the maximum concurrent pollers (1000 by default).

TLDR: This behaviour is normal in most applications, including zabbix.

[cyber]

What is there in the other end of those connections? That 192.168.100.110 host?

[gunnarson]

Hi Cyber,
yes, .33 is the agent computer and .100 is the zabbix server host. Any idea? It's look like IP scan or so.

[MRedbourne]

This is quite normal in traditional networking. I'm assuming this is a passive zabbix agent?

2 Passive and active agent checks

For example, for supported items:

1. Server opens a TCP connection

Every time the Zabbix server requests an item from the Zabbix agent, it opens a new TCP in the ephemeral port range. Most applications do this that operate in the TCP/IP stack, including your web browser when accessing things like the zabbix web forums.


104.26.6.148 is the Zabbix webforum for example. Note that my host machine (192.168.1.112) is connecting from a high port to port 443 on the web server. Zabbix will automatically open the number of connections it needs in order to have that amount of data flow, up to whatever is the maximum concurrent pollers (1000 by default).

TLDR: This behaviour is normal in most applications, including zabbix.

[gunnarson]

Sorry, my mistake, it was probably too late in the evening. I configured a passive agent and forgot that the agent was the query target, and of course, this leads to local dynamic ports on the Zabbix server. My thoughts were still in terms of a classic client-server scenario, and so I misinterpreted the tcpview output. Sorry guys.