Johanes Posted November 5, 2021 Posted November 5, 2021 Hi,I installed a fresh image today, one Armbian_21.08.3_Bananapipro_focal_current_5.10.60.img. Short check showed that there is an undefined traffic taking place, please see images. funny is that the open ports are not associated with any processes. does anyone have an idea what is behind it? buggy? trojan in the kernel? Johanes
Werner Posted November 5, 2021 Posted November 5, 2021 Moved to Common issues / peer to peer technical support
Heisath Posted November 8, 2021 Posted November 8, 2021 192.168.2.222 is probably the host you are using to connect to the bananapi via SSH, you have 2 connections open -> The two Port 22 tcp. time01.nevondo.com AND ntp2.wup-de.... Are probably NTP hosts your system is using to synchronize the time. NTP uses UDP via port 123. Which totally explains your UDP log (incoming from NTP server port 123, outgoing from your box on random free port) *.canonical.com are all Ubuntu Servers, so you are using an ubuntu system and it is doing some background stuff (Updates? Status?) littlericket.me seems to be some kind of Telegram bot. No idea if you are using that in any way https://botostore.com/c/messagestatisticsbot/ (see subscribe/unsubscribe url) I think that was all - btw easily googleable. Or what undefined traffic did you mean?
Johanes Posted November 12, 2021 Author Posted November 12, 2021 as i said, the installation is native and fresh. also, i have removed all useless services, such as avahi*, unattended-upgrades, etc. only ssh and ntp are running. so my question: where are the canonical and other undefined connection attempts coming from?? where can i find the responsible code in the system?
Werner Posted November 12, 2021 Posted November 12, 2021 Since Armbian does only minimal adjustments to the userspace a better place asking might be here: https://ubuntuforums.org/
Johanes Posted November 12, 2021 Author Posted November 12, 2021 ok i see. i think i should forget the ubuntu. will try to bring openbsd up
Werner Posted November 12, 2021 Posted November 12, 2021 Let us know how it works out Btw. you still have the option to go for Debian (Buster or Bullseye) flavor of Armbian.
xwiggen Posted November 12, 2021 Posted November 12, 2021 2 hours ago, Johanes said: as i said, the installation is native and fresh. also, i have removed all useless services, such as avahi*, unattended-upgrades, etc. only ssh and ntp are running. so my question: where are the canonical and other undefined connection attempts coming from?? where can i find the responsible code in the system? On 11/8/2021 at 7:29 AM, Heisath said: *.canonical.com are all Ubuntu Servers, so you are using an ubuntu system and it is doing some background stuff (Updates? Status?) littlericket.me seems to be some kind of Telegram bot. No idea if you are using that in any way https://botostore.com/c/messagestatisticsbot/ (see subscribe/unsubscribe url) Those are all NTP requests to a network pool, check the sizes (61b/15b), nothing wrong here move along
Recommended Posts