Any one know about UDP traffic on source port 26221?

Question

On my captured network traffic i observe a flow having a source udp port of 26221 and have different destination udp ports. Some of these destination ports were standards IANA ports. The average packet size of these flows were 145 bytes and there were 364 packets within a minute of captured traffic.The destination addresses contains 2 unused ip addresses in IANA table, after 7 minutes the PC resume sending on the same port but the packets size was different.

Any body know if it is a normal traffic or not? any further check I may use to determine if this is benign or not? I goggled for port 26221 but i didn't find something about it.

source port is not important, unless very peculiar cases. You should instead see what are the destination ports, and the type of packets that are sent (and received?) — Olivier Dulac, Dec 31 '12 at 13:07

rook · Answer 1 · 2012-12-29T15:53:31.593

1

The source port is almost always randomized so this information does not help classify the type of traffic. The packet's contents may contain identifying information or the destination port may help, for example destination port 53 is probably DNS.

WireShark is pretty good about identifying traffic, and I am pretty sure it doesn't look at the source or destination port numbers.

edited Dec 29 '12 at 15:53

answered Dec 29 '12 at 15:26

rook

47,238
10
96
182

Hi @Rook, thanks for your reply. I allready used wireshark. I want to add an information,in wireshark all the packets are black (which means udp checksum is bad, and I don't know how this information can help) and the destination port takes an increasing manner and then starts from 6000,sometimes for about 10 packet it keeps the same dst port, at the end some known ports are used, for all packets the protocol is UDP, it didn't show any other protocol name other than udp. regards. thanks again. – leena Dec 29 '12 at 16:18
1

@leena Then there is not enough information to answer this question. – rook Dec 29 '12 at 19:28
Could you provide the wireshark session file? – happy Dec 30 '12 at 21:12

score 1 · Accepted Answer · edited Mar 17 '17 at 10:46

Are use using any P2P file sharing or voip application. As these application usually operate on higher destination ports. Netstat is a simple command line tools that displays all active connections unless you are not affected by a rootkit.If you are still not sure this is a malware generated traffic or not then use a window firewall or IPtables for linux to block flows having restricted destination udp port. You should review some previous posts that may be a little help

Does the two unused ip addresses mean any thing? – leena Dec 29 '12 at 17:26 — leena, Dec 29 '12 at 17:26

score 1 · Answer 3 · answered Dec 31 '12 at 13:21

You could first determine which process is sending those packets.

on unix (linux, etc) : you can use lsof ( ex: lsof | grep 26221) to see which process is hooked on that port.
on windows, you can see which process uses which port with Sysinternal's TcpView

Then you'll have a better idea of the type of things this process should be doing (or shouldn't).

From there, using packet logging (on unix : tcpdump or on windows: WireShark) will help in knowing what kind of traffic is exchanged.

Then ask, giving relevant informations (process name, what type of packets it sends, etc) and we'll be maybe able to further help.

Remember, in case of a compromised machine, the best course is most often to completely reinstall (just backup the documents and config files before, do not keep librairies, dll, executables)

Any one know about UDP traffic on source port 26221?

3 Answers3