search

danswer-ai / danswer

Gen-AI Chat for Teams - Think ChatGPT if it had access to your team's unique knowledge.
https://docs.danswer.dev/
Other
9.77k stars 1.09k forks source link

Could a self-hosted danswer cause a netscan? #1636

Open danielnaber opened 2 weeks ago

danielnaber commented 2 weeks ago

We have a test instance of danswer running, using the docker compose command from the docs. Our hosting company says a netscan is happening from that server and has blocked it. They have sent us this log file (I've replaced parts of the IP address with xxx.xxx).

> #############################################################################
> #       Netscan detected from host 95.217.xxx.xxx                            #
> #############################################################################
>
>
> TIME (UTC)           SRC        SRC-PORT -> DST          DST-PORT SIZE PROT
> ---------------------------------------------------------------------------
> 2024-06-14 04:15:33  95.217.xxx.xxx 48482 ->     192.168.0.1  5432   78 TCP
> 2024-06-14 04:15:34  95.217.xxx.xxx 48482 ->     192.168.0.1  5432   78 TCP
> 2024-06-14 04:15:34  95.217.xxx.xxx 39366 ->     192.168.0.2  5432   78 TCP
> 2024-06-14 04:15:33  95.217.xxx.xxx 39366 ->     192.168.0.2  5432   78 TCP
> 2024-06-14 04:15:34  95.217.xxx.xxx 44298 ->     192.168.0.3  5432   78 TCP
> 2024-06-14 04:15:33  95.217.xxx.xxx 44298 ->     192.168.0.3  5432   78 TCP
> 2024-06-14 04:15:34  95.217.xxx.xxx 58504 ->     192.168.0.4  5432   78 TCP
> 2024-06-14 04:15:33  95.217.xxx.xxx 58504 ->     192.168.0.4  5432   78 TCP
> 2024-06-14 04:15:34  95.217.xxx.xxx 49982 ->     192.168.0.5  5432   78 TCP
> 2024-06-14 04:15:33  95.217.xxx.xxx 49982 ->     192.168.0.5  5432   78 TCP[...]

We're quite sure nothing else on this server can cause this, and it happened shortly after setting up danswer. Is anything known about this? Could any of the docker containers cause this?

IAmStoxe commented 2 weeks ago

5432 is postgres. You likely at your env to 192.168.0.1