Banana Pi Pro undefined traffic?

[Johanes]

Hi,I installed a fresh image today, one Armbian_21.08.3_Bananapipro_focal_current_5.10.60.img.
Short check showed that there is an undefined traffic taking place, please see images. funny is that the open ports are not associated with any processes. does anyone have an idea what is behind it? buggy? trojan in the kernel?  Johanes

[Werner]

Moved to Common issues / peer to peer technical support

[Heisath]

192.168.2.222 is probably the host you are using to connect to the bananapi via SSH, you have 2 connections open -> The two Port 22 tcp.

 

time01.nevondo.com AND

ntp2.wup-de....    Are probably NTP hosts your system is using to synchronize the time. NTP uses UDP via port 123. Which totally explains your UDP log (incoming from NTP server port 123, outgoing from your box on random free port)

 

*.canonical.com are all Ubuntu Servers, so you are using an ubuntu system and it is doing some background stuff (Updates? Status?)

littlericket.me seems to be some kind of Telegram bot. No idea if you are using that in any way https://botostore.com/c/messagestatisticsbot/ (see subscribe/unsubscribe url)

 

I think that was all - btw easily googleable. Or what undefined traffic did you mean?

[Johanes]

as i said, the installation is native and fresh. also, i have removed all useless services, such as avahi*, unattended-upgrades, etc.  only ssh and ntp are running. so my question: where are the canonical and other undefined connection attempts coming from?? where can i find the responsible code in the system? 

[Werner]

Since Armbian does only minimal adjustments to the userspace a better place asking might be here: https://ubuntuforums.org/

[Johanes]

ok i see. i think i should forget the ubuntu. will try to bring openbsd up

[Werner]

Let us know how it works out

 

Btw. you still have the option to go for Debian (Buster or Bullseye) flavor of Armbian.

[xwiggen]

2 hours ago, Johanes said:

as i said, the installation is native and fresh. also, i have removed all useless services, such as avahi*, unattended-upgrades, etc.  only ssh and ntp are running. so my question: where are the canonical and other undefined connection attempts coming from?? where can i find the responsible code in the system? 

 

On 11/8/2021 at 7:29 AM, Heisath said:

 

*.canonical.com are all Ubuntu Servers, so you are using an ubuntu system and it is doing some background stuff (Updates? Status?)

littlericket.me seems to be some kind of Telegram bot. No idea if you are using that in any way https://botostore.com/c/messagestatisticsbot/ (see subscribe/unsubscribe url)

 

Those are all NTP requests to a network pool, check the sizes (61b/15b), nothing wrong here move along