Today I received my first alert from AWS GuardDuty that concerns me though I'm not sure how to assess the severity.

I received what appears to be an outgoing connection (or at least an attempt) to an address in another country. However the amount of data is very small and the inbound and outbound ports on the local ftp server port.

In bytes     Local port
1920         21

Out bytes    Unusual
2096         21

This looks like it might be errant data but I'm not sure. I would expect inbound traffic from a successful connection to be on some random high port. I'm not sure what would cause something that looks like this unless a probe sent a malformed packet and Guard Duty "thinks" it's an outgoing connection attempt.

Is there anything I can check that would explain a finding like this and help me understand if I need to or can do anything about it?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.