J
J
jenya77712022-02-05 18:01:01
proxy
jenya7771, 2022-02-05 18:01:01

Why are there so many TCP requests when connecting via socks5?

Hello, there is server_1 and server_2.

server_2 connects to server_1 on a specific port via socks5.

And when server_1 sends some data to server_2, Hetzner sends us an email with this log:

log file

##########################################################################
#              Portscan detected from host     server_1               #
##########################################################################

time                protocol src_ip src_port          dest_ip dest_port
---------------------------------------------------------------------------
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 49074
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 47185
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48499
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48552
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48016
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48730
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48762
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48060
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48767
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 49039
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 47121
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48557
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 47740
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 49055
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 49338
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 49293
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48457
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48095
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48747
Sat Feb  5 01:02:28 2022 TCP     server_1 34922 =>    server_2 48473


1000 таких запросов


Why is the server_2 port always different?
What could be such a reason?
This is normal for the socks5 protocol, how can this be explained?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question