Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 2 subscribers
  • Views 5016 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Port 10101 --> Symantec

SalishSwede
I noticed a great deal of entries in my IPS log.

They all look like this: 
2011:12:28-15:50:29 wahine ulogd[5994]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="eth0" srcmac="4:c:ce[:D]c:50:82" dstmac="0:c:29:67:ac:84" srcip="10.1.2.3"[my mac client]  dstip="198.153.192.3" proto="17" length="237" tos="0x00" prec="0x00" ttl="64" srcport="55439" dstport="10101" 

Note the destination port: 10101 
This is the same port that Astaro used for it's "cloud based" log management.
Destination ip:  198.153.192.3 [details below]


The destination IP address is for the following: 
   NetRange: 198.153.190.0 - 198.153.196.255
   CIDR:198.153.190.0/23, 198.153.196.0/24, 198.153.192.0/22
   NetType: Direct Assignment
   OrgName:Symantec Corporation
   Address:20330 Stevens Creek Blvd
   City:Cupertino
   StateProv:CA
   OrgAbuseName:Symantec IP Administrator
   OrgAbusePhone:+1-650-527-8000
   OrgAbuseEmail[:D]l-it-ip-admin@symantec.com

I have no Symantec products installed on my machine.

Question:  Is there any official relationship between Astaro and Symantec that might explain this traffic?

Can any one assist in identifying this traffic?

Thanks,

Dougga


This thread was automatically locked due to age.
Parents
  • 0
    I'm pretty sure I deactivated it before it disappeared.  I wonder if you might not need to go back to a version that still had it with an old config backup, and disable it there.  I dunno.  Maybe a clean, new install would be best...

    Cheers - Bob
  • 0 in reply to BAlfson
    Yes, I'll do that.
    I believe I have done that so I'm wondering if the config backups are somehow re-implementing something.
    I'll have to manually document the configuration to avoid this issue.
    [Feature Request]  A human readable config dump so admins can audit and rebuild a system without having to rely on the config backup feature.
    Also I'm still puzzled as to why all of my Syslogs would be going to an address at Symantec Corp? I originally placed a firewall rule blocking all traffic involving port 10101.  At some point I deleted it thinking there's no chance this was still an issue.  [I don't keep logs of changes]  Evidently this is still an issue.  

    Can you help me out with this?  Was the service a Symantec offering that you were embedding in ASL?
  • 0 in reply to SalishSwede
    Oh yes, where would I look for clues using the CLI that the Log Manager was still active?
Reply Children
No Data