On Thu, Dec 21, 2023 at 12:00:55PM +0000, Alain D D Williams wrote: > My home PC is receiving, for hours at a time, 12-30 kB/s input traffic. This > is > unsolicited. I do not know what it is trying to achieve but suspect no good. > It > is also eating my broadband allowance.
> 11:08:56.354303 IP 34.217.144.104.80 > 192.168.108.2.80: Flags [S], seq > 19070976, win 51894, options [mss 1401,sackOK,TS val 1182532729 ecr > 0,nop,wscale 7], length 0 34.217.144.104 appears to be an Amazon AWS system. > 11:08:56.360527 IP 52.195.179.12.80 > 192.168.108.2.80: Flags [S], seq > 479395840, win 51894, options [mss 1412,sackOK,TS val 3391683448 ecr > 0,nop,wscale 7], length 0 As does 52.195.179.12. > 11:08:56.367975 IP 13.231.232.88.80 > 192.168.108.2.80: Flags [S], seq > 3272540160, win 51894, options [mss 1413,sackOK,TS val 979961209 ecr > 0,nop,wscale 7], length 0 Same for 13.231.232.88. I'm not 100% sure how to read these logs, but it looks like you're running a web server on your local system...? I see .80 after your internal IP address, which I'm assuming means you have a service running on port 80, which is normally HTTP. If your home Internet service has an "allowance", you probably shouldn't run a web server on it. If your web site becomes popular all of a sudden (these things happen -- one link posted in the right place can drive a ton of traffic to you with no warning), your "allowance" could be completely exhausted in a day. You really should consider moving this web service to a provider with no bandwidth limits. There are many available, and they're cheap.
