Detect Outbound Port 25: Bash, Tcpdump & Lsof Guide

Aug 13, 2025 by Felix Dubois 52 views

Detecting and Preventing Outbound Port 25 Connections: A Comprehensive Guide

Hey guys! Ever find your server's IPv6 address on a blocklist and wonder why? It's a frustrating situation, especially when the evidence points to unwanted outbound connections on port 25 with a suspicious EHLO. This comprehensive guide is designed to help you identify, understand, and resolve the issue. We'll dive into practical methods using bash, tcpdump, and lsof to detect these connections and then discuss strategies to prevent them from happening again. So, let's get started and keep those IPs off the blocklists!

Understanding the Problem: Outbound Port 25 and Blocklists

Before we jump into the technical stuff, let's understand why outbound connections on port 25 are a red flag. Port 25 is the standard port for SMTP (Simple Mail Transfer Protocol), used for sending emails. If your server, which isn't supposed to be an email server, is making outbound connections on this port and issuing an EHLO (Extended Hello) with an IP address instead of a proper hostname, it raises suspicion. Mail servers often block such connections because they are indicative of spamming activities. Spammers frequently use compromised servers or botnets to send out unsolicited emails, and these connections often originate from unexpected sources.

So, when your IPv6 address lands on a blocklist due to these outbound port 25 connections, it means your server is suspected of sending spam. This can disrupt your legitimate services, as your server might be unable to communicate with other servers that use the blocklist. To prevent this, we need to identify the process or application making these connections and take corrective actions. This involves using tools like tcpdump to capture network traffic, lsof to list open files and network connections, and bash scripting to automate the detection process. We'll explore how to use these tools effectively in the following sections.

The first step in tackling this issue is to actively monitor and detect suspicious outbound connections. By identifying the process or script responsible, you can implement the necessary security measures to protect your server's reputation and avoid future blocklisting. Understanding the underlying causes and employing proactive monitoring are key to maintaining a healthy server environment. So, let's dive into the practical methods for detecting these connections using the powerful tools at our disposal.

Detecting Outbound Connections with `tcpdump`

tcpdump is your best friend when it comes to network traffic analysis. This powerful command-line packet analyzer allows you to capture and inspect network packets in real-time. To detect outbound connections on port 25, we can use tcpdump to filter traffic based on the destination port. Let's break down how to do this and what to look for.

The basic command to capture traffic on port 25 is:

sudo tcpdump -i <interface> port 25

Replace <interface> with the network interface you want to monitor (e.g., eth0, enp0s3). You might need to use ifconfig or ip addr to identify the correct interface. This command will capture all packets going to or coming from port 25. However, since we are interested in outbound connections, we can refine the filter:

sudo tcpdump -i <interface> dst port 25

The dst keyword ensures we only see packets where port 25 is the destination. Now, let's interpret the output. tcpdump will display each packet's details, including the source and destination IP addresses, port numbers, and flags. Look for connections originating from your server's IP address and going to port 25. If you see a connection, the next step is to examine the packet content.

To see the contents of the packets, you can use the -A flag, which displays the data in ASCII format:

sudo tcpdump -i <interface> dst port 25 -A

This will reveal the data being transmitted, including the EHLO command. Look for EHLO commands that contain an IP address instead of a fully qualified domain name (FQDN). This is a strong indicator of potential spamming activity. For example, you might see something like EHLO 192.168.1.100 instead of EHLO mail.example.com. Once you've identified suspicious connections using tcpdump, the next step is to pinpoint the process responsible for these connections. This is where lsof comes into play.

Identifying the Process with `lsof`

lsof (List Open Files) is a command-line utility that displays information about files opened by processes. In the context of network connections, it can show you which process is using a particular port. To find the process making outbound connections on port 25, we can use lsof in conjunction with grep to filter the output.

The command to list processes using port 25 is:

sudo lsof -i :25

This command lists all processes that have port 25 open, either for listening or making connections. The output will include columns like COMMAND (process name), PID (process ID), USER, and NAME (network connection details). Look for entries where the NAME column shows a connection to a remote server on port 25. For example, you might see something like TCP your_server_ip:random_port->remote_server_ip:smtp (ESTABLISHED). The smtp here indicates port 25.

However, this command might show legitimate mail processes if your server is indeed supposed to send emails. To narrow down the results to only outbound connections, we can combine lsof with grep to filter for ESTABLISHED connections, which indicate active outbound connections:

sudo lsof -i :25 | grep ESTABLISHED

This will display only the processes actively making connections on port 25. Once you've identified the process, you can investigate further. Note the PID (Process ID) and the COMMAND name. You can then use commands like ps aux | grep <PID> or ps aux | grep <COMMAND> to get more details about the process, including its user, start time, and command-line arguments. This information is crucial for understanding why the process is making these connections.

If the process is unexpected or malicious, you can take action to stop it. You can use the kill command to terminate the process:

sudo kill <PID>

However, simply killing the process is a temporary solution. You need to address the root cause of the problem. This might involve removing malware, patching vulnerabilities, or reconfiguring applications. The combination of tcpdump and lsof gives you the ability to detect and identify the processes making unwanted outbound connections. Next, we'll explore how to automate this detection process using bash scripting, making it easier to monitor your server proactively.

Automating Detection with Bash Scripting

Manually running tcpdump and lsof periodically can be tedious and impractical for continuous monitoring. This is where bash scripting comes to the rescue! We can create a script to automate the detection process and even send alerts when suspicious activity is detected. Let's walk through how to build such a script.

First, we'll create a basic script that captures outbound port 25 connections using tcpdump, filters the output, and then uses lsof to identify the process. Here's a sample script:

#!/bin/bash

INTERFACE="eth0" # Replace with your network interface
LOG_FILE="/var/log/outbound_port25.log"

# Capture outbound port 25 traffic and log it
tcpdump -i $INTERFACE dst port 25 -A -c 10 2>/dev/null | grep -i "EHLO" > $LOG_FILE

# Check if any suspicious traffic was captured
if [ -s $LOG_FILE ]; then
 echo "Suspicious outbound traffic detected on port 25:" 
 cat $LOG_FILE

 # Identify the process using lsof
 lsof -i :25 | grep ESTABLISHED
else
 echo "No suspicious outbound traffic detected on port 25."
fi

Let's break down this script:

#!/bin/bash: This shebang line specifies that the script should be executed with bash.
INTERFACE="eth0": This sets a variable for the network interface. Remember to replace eth0 with your actual interface name.
LOG_FILE="/var/log/outbound_port25.log": This sets the path to the log file where captured traffic will be stored.
tcpdump -i $INTERFACE dst port 25 -A -c 10 2>/dev/null | grep -i "EHLO" > $LOG_FILE: This is the core of the script. It uses tcpdump to capture up to 10 packets (-c 10) with the -A flag to display the content in ASCII format. It filters traffic destined for port 25 and pipes the output to grep -i "EHLO", which filters for lines containing “EHLO” (case-insensitive). The 2>/dev/null redirects error messages to prevent them from cluttering the output. Finally, the output is redirected to the log file.
if [ -s $LOG_FILE ]; then: This checks if the log file is not empty, indicating that suspicious traffic was captured.
echo "Suspicious outbound traffic detected on port 25:": If suspicious traffic is detected, this message is printed.
cat $LOG_FILE: This displays the contents of the log file.
lsof -i :25 | grep ESTABLISHED: This uses lsof to list processes making connections on port 25 and filters for ESTABLISHED connections.
else: If no suspicious traffic is detected, this block is executed.
echo "No suspicious outbound traffic detected on port 25.": This message is printed if no suspicious traffic is detected.

To make this script more useful, you can add email alerts. For example, you can use the mail command to send an email when suspicious traffic is detected. Here's how you can modify the script to include email alerts:

#!/bin/bash

INTERFACE="eth0" # Replace with your network interface
LOG_FILE="/var/log/outbound_port25.log"
EMAIL_ADDRESS="[email protected]" # Replace with your email address

# Capture outbound port 25 traffic and log it
tcpdump -i $INTERFACE dst port 25 -A -c 10 2>/dev/null | grep -i "EHLO" > $LOG_FILE

# Check if any suspicious traffic was captured
if [ -s $LOG_FILE ]; then
 echo "Suspicious outbound traffic detected on port 25:" 
 cat $LOG_FILE

 # Identify the process using lsof
 PROCESSES=$(lsof -i :25 | grep ESTABLISHED)
 echo "Processes using port 25:" 
 echo "$PROCESSES"

 # Send email alert
 SUBJECT="Suspicious Outbound Traffic on Port 25"
 BODY="Suspicious traffic detected:\n$(cat $LOG_FILE)\nProcesses:\n$PROCESSES"
 echo "$BODY" | mail -s "$SUBJECT" $EMAIL_ADDRESS
else
 echo "No suspicious outbound traffic detected on port 25."
fi

In this modified script:

EMAIL_ADDRESS="[email protected]": This sets a variable for the email address to send alerts to. Remember to replace [email protected] with your actual email address.
PROCESSES=$(lsof -i :25 | grep ESTABLISHED): This captures the output of the lsof command.
SUBJECT="Suspicious Outbound Traffic on Port 25": This sets the subject of the email.
BODY="Suspicious traffic detected:\n$(cat $LOG_FILE)\nProcesses:\n$PROCESSES": This creates the body of the email, including the contents of the log file and the output of the lsof command.
echo "$BODY" | mail -s "$SUBJECT" $EMAIL_ADDRESS: This sends the email using the mail command.

To run this script regularly, you can use cron. For example, to run the script every 5 minutes, you can add the following line to your crontab (using crontab -e):

*/5 * * * * /path/to/your/script.sh

Remember to make the script executable using chmod +x /path/to/your/script.sh. This automated script will continuously monitor for suspicious outbound connections on port 25 and alert you via email, allowing you to take prompt action. However, detection is only the first step. We also need to implement preventative measures to avoid these issues in the future.

Preventing Outbound Port 25 Connections

Detecting and identifying the source of unwanted outbound port 25 connections is crucial, but preventing them in the first place is even better. There are several strategies you can employ to minimize the risk of your server being used for spamming. Let's explore some effective methods.

1. Firewall Rules

One of the most effective ways to prevent unwanted outbound connections is to configure your firewall to block traffic on port 25. If your server is not supposed to be sending emails directly, there's no legitimate reason for it to make outbound connections on this port. You can use tools like iptables or firewalld to set up these rules.

For iptables, you can use the following commands to block outbound traffic on port 25:

sudo iptables -A OUTPUT -p tcp --dport 25 -j DROP
sudo iptables -A OUTPUT -p tcp --dport 587 -j DROP
sudo iptables -A OUTPUT -p tcp --dport 465 -j DROP

These commands add rules to the OUTPUT chain, which handles outbound traffic, to drop TCP packets destined for ports 25, 587, and 465. These are the standard ports for SMTP, Submission (used for authenticated email submission), and SMTPS (SMTP over SSL), respectively. After adding these rules, it's essential to save them so they persist across reboots. The method for saving rules depends on your distribution, but it typically involves a command like sudo iptables-save > /etc/iptables/rules.v4.

If you're using firewalld, the commands are slightly different:

sudo firewall-cmd --permanent --add-rich-rule='rule family=