Destination Port 22

Started by strawberry, May 30, 2025, 09:17:53 PM

Previous topic - Next topic
Print
Go Down Pages1
User actions
May 30, 2025, 09:17:53 PM
I am seeing firewall live view showing multiple flows at similar time intervals with a destination port 22 and its saying its allowed because it the rule of let anything out from the firewall host itself.  It is generated, the view shows, from the firewall.  Is there a service that would send something out on towards this destination port (TCP Port 22) to multiple ip's.
May 30, 2025, 10:04:02 PM #1
Are you using ssh for anything?
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)
May 30, 2025, 10:20:27 PM #2
Not that I was aware of. Oddly enough I removed the NTOPNG service/package and haven't seen an occurrence since then.
May 30, 2025, 10:24:45 PM #3
Ntopng scans for vulnerabilities in your network including SSH on port 22 ...
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)
May 30, 2025, 10:29:19 PM #4
Ok.  That explains it I think.  Port 22, Port 8080, Port 80 were being sent traffic from the firewall interface to one of the lan interfaces and towards some wan ip's off of spectrum network, which seems odd.  But I am new and glad to have a valid answer.  Thanks!
Print
Go Up Pages1
User actions