Unwanted Traffic

[so_2]

Hi All,

I am having an HPUX server running 11.23.
I am able to see some unwanted , unknown traffic is created by the server at port 9100/
The trafic is intended to an ip 99.99.99.99, but there are no such host in my network.
This is isn "syn_sent" state.
How do I know what is this? why is this happening? and how to stop this.

The 9100 is the port using for jetadmin service and I have around 400 printers configured on this server. All printers are working fine.

Please find the details i capured using netstat
tcp 0 0 10.214.8.68.64954 28.7.252.6.9100 TIME_WAIT
tcp 0 0 10.214.8.68.64946 28.1.253.221.9100 TIME_WAIT

tcp 0 1 10.214.8.68.64911 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.64922 10.210.101.212.9100 SYN_SENT
tcp 0 0 10.214.8.68.64951 10.210.101.159.9100 ESTABLISHED


Please advise.
Thanks in advance.

[Steven E. Protter · Accepted solution]

Shalom,

To really stop it, find the source and get that application to stop doing this. The source is off your system, not on your system.

You can stop the traffic with the ipfilter firewall, but this does not really solve the problem.

SEP

[Kofi ARTHIABAH]

Hello So:

If you have lsof installed, you can track down the process that is generating that traffic with

lsof -i :64911

is it possible that one of your configuration files may have inserted an invalid IP address and therefore got defaulted to 99.99.99.99 - that looks suspiciously like a default string of some sort. I would say track down the process that is trying to connect to that IP address, and use lsof -p and see what files it references, look through any config files for odd looking numbers or characters and that might be it.

Good luck.

Kofi