Device talking to itself

Solved
DanIsTaken
Here to help

Device talking to itself

Hello and good part of the day you are!

So I have been having several "Microsoft Windows Terminal server RDP over non-standard port attempt" on wich I have blocked the attackers I.P. and their country traffic. The MX successfully blocked the attacks but theres something bugging me. One of the affected machines, an NVR, is communicating with itself over its public IP address. What do I mean? the NVR private ip x.x.x.250 is reaching its NAT 1:1 x.x.x.7 IP address over TCP port 80, why this machine would establish communication with itself?

Also this same machine is establishing contact with a remotewd.com host for some reason over port 80 and 455 both TCP.

 

Another machine, a NAS, affected by RDP is contacting the same remotewd.com host but over ICMP.

 

Am I just confused and paranoid here or theres something else going on?

1 Accepted Solution
PhilipDAth
Kind of a big deal
Kind of a big deal

Note that the RDP over non-stand port warning is really only an issue if you have NAT'ed through ports to an machine offering RDP on a non-standard port.

 

Otherwise you can ignore this.

View solution in original post

2 Replies 2
SoCalRacer
Kind of a big deal

From my understanding remotewd.com is a Western Digital cloud backup service. Are these devices doing cloud backup/sync?

 

My guess on the NVR is is verifying it is publicly accessible, might need to contact the vendor of the devices though.

PhilipDAth
Kind of a big deal
Kind of a big deal

Note that the RDP over non-stand port warning is really only an issue if you have NAT'ed through ports to an machine offering RDP on a non-standard port.

 

Otherwise you can ignore this.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels