Forum Discussion

Mohanish_169493's avatar
Mohanish_169493
Icon for Nimbostratus rankNimbostratus
Nov 28, 2015

Suspicious traffic over GTM

Hi,

 

We are seeing some suspicious traffic over GTM. We are seeing its listener IP address making multiple conmectiins to some IP addresses over the internet over port 22.

 

This is generating traffic over the GTm to the amount of TB. We are seeing close to 3 lakh connection in connection table.

 

What can be the cause of this. How to prevent this. We have GTM directly exposed to internet and no FW in between

 

application delivery
BIG-IP
BIG-IP DNS
big-ip gtm
gtm

3 Replies

Sort By
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Nov 28, 2015
    what is: 3 lakh connection ? are you sure the traffic is outgoing? what kind of IPs are involved, do they make sense for you company or ...? if you are unsure i would call support directly and let them investigate, if the box is compromised you want that fixed asap.
  • Mohanish_169493's avatar
    Mohanish_169493
    Icon for Nimbostratus rankNimbostratus
    Nov 28, 2015
    hi, I can see multiple IP addresses from my Public segment making connections to some unknown randon IP's over the internet on port 80. Can it be possible that my GTM is compromised or it could be that some servers sitting behind it are compromised.
  • IanB's avatar
    IanB
    Icon for Employee rankEmployee
    Feb 09, 2016

    a lakh = 1 hundred thousand.

     

    I would suggest the box has probably been compromised. You should reinstall the OS and restore the config from a UCS, and open a support case to check there aren't unexpected files in the UCS. Make sure that your port lockdown settings are appropriate and do not allow connections to public facing self-ips (allow none), allowing tcp/4353 where appropriate for iQuery.