OpenWrt Forum Archive

Topic: netstat Reports Suspicious Connection

The content of this topic has been archived on 1 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

netstat is reporting a suspicious connection from a public IP address to my public IP address on port 2050. Should I be worrying about this connection?

udp        0      0 <my_ip_address>:2050       <some_other_public_IP>:123        ESTABLISHED

I don't have this port open, so I wouldn't expect a connection. I ran nslookup on the suspicious IP, but haven't been able to determine whether it might be malicious.

Does this look suspicious or should I not worry about this connection?

I'm running a fresh install of White Russian 0.9 with the default iptable settings.

Are you sure that's not a connection to a time server? UDP 123 is the standard port for NTP.

Doh! Yes, it is a time server. Now I can rest easy.

Thanks for the help.

The discussion might have continued from here.