Constant traffic to unknown IP

General Help
1

Hi,
i noticed constant (24/7) traffic from my freepbx instance to Ip address 87.253.160.18:80.
I could not find any information about that ip (except is does not belong to my provider) online.
I did not add any Plugins or modules to the installation.
Does anybody know what this ip belongs to? Is this part of freepbx or is it something i should worry about?

grafik
grafik812Ă—399 11.2 KB

2 
 whois -h whois.cymru.com  ' -v  87.253.160.18'
AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | AS Name
9211    | 87.253.160.18    | 87.253.160.0/20     | DE | ripencc  | 2005-10-06 | WORK-AS n@work Internet Informationssysteme GmbH, DE
1 Like
3

That’s what i found out by googling the ip. But as far as i found out, this company has nothing to do with my provider (German Telekom). So Why should freepbx connect to that?

4

Well, we see a conversation going on but from your post, “You started it at line 1” :slight_smile:

tcpdump  -s 0 -AX 'tcp dst port 80 and host 87.253.160.18'

would be a little more diagnostic.

1 Like
5

tcpdump
tcpdump924Ă—754 31.1 KB

Does not look like a http request.

6

now replace dst with src (or remove it) to get the responses

1 Like
7

tcpdump2
tcpdump2970Ă—924 50.3 KB

also nothing human readable

8

I found the answer to “who is this ip”:
someone added a radio webstream as holdmusik. A dns lookup of the stream address showed 87.253.160.18. That explains the unreadable http responses.

Thanks for your Help @dicko

2 Likes
9

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.