question Re: dht_pkt_alert Possible malicious infection in CDH6 in Support Questions

dht_pkt_alert Possible malicious infection in CDH6

Juanes — Wed, 22 May 2024 07:09:23 GMT

Hello Community,

I have an old CDH6 and realized the following suspicious traces in cloudera.flood.log in /var/log/cloudera-scm-server

dht_pkt_alert ==> [82.43.248.101:6881]

dht_pkt_alert <== [82.43.248.101:6881]

and the same for another almost 100 different IPs outside the network by using the p2p libraries (and not sure that they are Cloudera Repository Ps)

Did you see anything similar? this activity is quite suspicious.

Thanks for your help

Re: dht_pkt_alert Possible malicious infection in CDH6

robert199re — Fri, 24 May 2024 09:53:55 GMT

The dht_pkt_alert messages you’re seeing in the cloudera.flood.log are indicative of Distributed Hash Table (DHT) packet alerts, which are associated with peer-to-peer (P2P) network activity. This type of activity is unusual for a Cloudera CDH6 environment and could potentially point to a security concern, such as unauthorized software or a compromised system.

Re: dht_pkt_alert Possible malicious infection in CDH6

Juanes — Mon, 27 May 2024 07:28:19 GMT

Thank you @robert199re for the information, the system is isolated, I would do some additional investigations but not I can asume that this traffic is not usual for CDH6.

Best Regards