hddtemp deamon - port scan?

31 Aug 2009

      Hallo zusammen,

im Rahmen eine anderen Projektes (OTR für SipCommunicator) hab ich
mit wireshark die "lo" Schnittstelle überwacht. Neben den Jabber
Nachrichten, die ich eigentlich prüfen wollte, habe ich eine
Menge requests von hddtemp gesehen.

hddtemp scheint nacheinander all TCP ports zu öffnen, ein paar
Daten werden gesendet, Port wird geschlossen, nach 10 Sekunden
ist der nächste Port dran. Ich habe ein bischen "rum-gegoogled"
aber keine Erklärung für das Verhalten gefunden. Kennt einer von
euch das Verhalten von hddtemp?

Unten mal eine wireshark Ausgabe von einem kompletten
Datenaustausch von hddtemp. Was mich etwas stutzig macht ist die
Tatsache dass die Kommunikation nicht vom eigentlichen hddtemp
port (7634) gestartet wird sondern von dem "anderen" Port. Dann
schickt hddtemp "0x7c" and den anderen Port und dann einen
kurzen Text in dem "/dev/hda" enthalten ist.

Viele Grüsse,
Werner

Wireshark Ausgabe:

No.     Time        Source                Destination           Protocol Info
    122 63.722216   127.0.0.1             127.0.0.1             TCP      48698 > 7634 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=11679038 TSER=0 WS=7

Frame 122 (74 bytes on wire, 74 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 48698 (48698), Dst Port: 7634 (7634), Seq: 0, Len: 0
    Source port: 48698 (48698)
    Destination port: 7634 (7634)
    Sequence number: 0    (relative sequence number)
    Header length: 40 bytes
    Flags: 0x02 (SYN)
    Window size: 32792
    Checksum: 0xd6c3 [correct]
    Options: (20 bytes)

No.     Time        Source                Destination           Protocol Info
    123 63.722267   127.0.0.1             127.0.0.1             TCP      7634 > 48698 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=16396 TSV=11679038
TSER=11679038 WS=7

Frame 123 (74 bytes on wire, 74 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 7634 (7634), Dst Port: 48698 (48698), Seq: 0, Ack: 1, Len: 0
    Source port: 7634 (7634)
    Destination port: 48698 (48698)
    Sequence number: 0    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 40 bytes
    Flags: 0x12 (SYN, ACK)
    Window size: 32768
    Checksum: 0x6dce [correct]
    Options: (20 bytes)
    [SEQ/ACK analysis]

No.     Time        Source                Destination           Protocol Info
    124 63.722305   127.0.0.1             127.0.0.1             TCP      48698 > 7634 [ACK] Seq=1 Ack=1 Win=32896 Len=0 TSV=11679038 TSER=11679038

Frame 124 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 48698 (48698), Dst Port: 7634 (7634), Seq: 1, Ack: 1, Len: 0
    Source port: 48698 (48698)
    Destination port: 7634 (7634)
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
    Window size: 32896 (scaled)
    Checksum: 0x55f2 [correct]
    Options: (12 bytes)
    [SEQ/ACK analysis]

No.     Time        Source                Destination           Protocol Info
    125 63.722499   127.0.0.1             127.0.0.1             TCP      7634 > 48698 [PSH, ACK] Seq=1 Ack=1 Win=32768 [TCP CHECKSUM INCORRECT] Len=1
TSV=11679038 TSER=11679038

Frame 125 (67 bytes on wire, 67 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 7634 (7634), Dst Port: 48698 (48698), Seq: 1, Ack: 1, Len: 1
    Source port: 7634 (7634)
    Destination port: 48698 (48698)
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 2    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32768 (scaled)
    Checksum: 0xfe29 [incorrect, should be 0xd9e9 (maybe caused by "TCP checksum offload"?)]
    Options: (12 bytes)
    [SEQ/ACK analysis]
Data (1 byte)

0000  7c                                                |

No.     Time        Source                Destination           Protocol Info
    126 63.722533   127.0.0.1             127.0.0.1             TCP      48698 > 7634 [ACK] Seq=1 Ack=2 Win=32896 Len=0 TSV=11679038 TSER=11679038

Frame 126 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 48698 (48698), Dst Port: 7634 (7634), Seq: 1, Ack: 2, Len: 0
    Source port: 48698 (48698)
    Destination port: 7634 (7634)
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
    Window size: 32896 (scaled)
    Checksum: 0x55f1 [correct]
    Options: (12 bytes)
    [SEQ/ACK analysis]

No.     Time        Source                Destination           Protocol Info
    127 63.722567   127.0.0.1             127.0.0.1             TCP      7634 > 48698 [PSH, ACK] Seq=2 Ack=1 Win=32768 [TCP CHECKSUM INCORRECT] Len=18
TSV=11679038 TSER=11679038

Frame 127 (84 bytes on wire, 84 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 7634 (7634), Dst Port: 48698 (48698), Seq: 2, Ack: 1, Len: 18
    Source port: 7634 (7634)
    Destination port: 48698 (48698)
    Sequence number: 2    (relative sequence number)
    [Next sequence number: 20    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32768 (scaled)
    Checksum: 0xfe3a [incorrect, should be 0x26f3 (maybe caused by "TCP checksum offload"?)]
    Options: (12 bytes)
    [SEQ/ACK analysis]
Data (18 bytes)

0000  2f 64 65 76 2f 68 64 61 7c 3f 3f 3f 7c 45 52 52   /dev/hda|???|ERR
0010  7c 2a                                             |*

No.     Time        Source                Destination           Protocol Info
    128 63.722593   127.0.0.1             127.0.0.1             TCP      48698 > 7634 [ACK] Seq=1 Ack=20 Win=32896 Len=0 TSV=11679038 TSER=11679038

Frame 128 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 48698 (48698), Dst Port: 7634 (7634), Seq: 1, Ack: 20, Len: 0
    Source port: 48698 (48698)
    Destination port: 7634 (7634)
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 20    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
    Window size: 32896 (scaled)
    Checksum: 0x55df [correct]
    Options: (12 bytes)
    [SEQ/ACK analysis]

No.     Time        Source                Destination           Protocol Info
    129 63.722623   127.0.0.1             127.0.0.1             TCP      7634 > 48698 [PSH, ACK] Seq=20 Ack=1 Win=32768 [TCP CHECKSUM INCORRECT] Len=1
TSV=11679038 TSER=11679038

Frame 129 (67 bytes on wire, 67 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 7634 (7634), Dst Port: 48698 (48698), Seq: 20, Ack: 1, Len: 1
    Source port: 7634 (7634)
    Destination port: 48698 (48698)
    Sequence number: 20    (relative sequence number)
    [Next sequence number: 21    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32768 (scaled)
    Checksum: 0xfe29 [incorrect, should be 0xd9d6 (maybe caused by "TCP checksum offload"?)]
    Options: (12 bytes)
    [SEQ/ACK analysis]
Data (1 byte)

0000  7c                                                |

No.     Time        Source                Destination           Protocol Info
    130 63.722647   127.0.0.1             127.0.0.1             TCP      48698 > 7634 [ACK] Seq=1 Ack=21 Win=32896 Len=0 TSV=11679038 TSER=11679038

Frame 130 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 48698 (48698), Dst Port: 7634 (7634), Seq: 1, Ack: 21, Len: 0
    Source port: 48698 (48698)
    Destination port: 7634 (7634)
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 21    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
    Window size: 32896 (scaled)
    Checksum: 0x55de [correct]
    Options: (12 bytes)
    [SEQ/ACK analysis]

No.     Time        Source                Destination           Protocol Info
    131 63.722677   127.0.0.1             127.0.0.1             TCP      7634 > 48698 [FIN, ACK] Seq=21 Ack=1 Win=32768 Len=0 TSV=11679038 TSER=11679038

Frame 131 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 7634 (7634), Dst Port: 48698 (48698), Seq: 21, Ack: 1, Len: 0
    Source port: 7634 (7634)
    Destination port: 48698 (48698)
    Sequence number: 21    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x11 (FIN, ACK)
    Window size: 32768 (scaled)
    Checksum: 0x55de [correct]
    Options: (12 bytes)
    [SEQ/ACK analysis]

No.     Time        Source                Destination           Protocol Info
    132 63.722783   127.0.0.1             127.0.0.1             TCP      48698 > 7634 [FIN, ACK] Seq=1 Ack=22 Win=32896 Len=0 TSV=11679038 TSER=11679038

Frame 132 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 48698 (48698), Dst Port: 7634 (7634), Seq: 1, Ack: 22, Len: 0
    Source port: 48698 (48698)
    Destination port: 7634 (7634)
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 22    (relative ack number)
    Header length: 32 bytes
    Flags: 0x11 (FIN, ACK)
    Window size: 32896 (scaled)
    Checksum: 0x55dc [correct]
    Options: (12 bytes)
    [SEQ/ACK analysis]

No.     Time        Source                Destination           Protocol Info
    133 63.722810   127.0.0.1             127.0.0.1             TCP      7634 > 48698 [ACK] Seq=22 Ack=2 Win=32768 Len=0 TSV=11679038 TSER=11679038

Frame 133 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 7634 (7634), Dst Port: 48698 (48698), Seq: 22, Ack: 2, Len: 0
    Source port: 7634 (7634)
    Destination port: 48698 (48698)
    Sequence number: 22    (relative sequence number)
    Acknowledgement number: 2    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
    Window size: 32768 (scaled)
    Checksum: 0x55dd [correct]
    Options: (12 bytes)
    [SEQ/ACK analysis]
-- 
Um die Liste abzubestellen, schicken Sie eine Mail an:
    opensuse-de+unsubscribe@opensuse.org
Um eine Liste aller verfuegbaren Kommandos zu bekommen, schicken
Sie eine Mail an: opensuse-de+help@opensuse.org

hddtemp deamon - port scan?

Werner Dittmann