# Logstash behaves like a portscanner **URL:** \ **Category:** Logstash\ **Created:** [September 24, 2019, 6:39am UTC](https://discuss.elastic.co/t/logstash-behaves-like-a-portscanner/200797 "2019-09-24T06:39:33Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![hoggle](https://avatars.discourse-cdn.com/v4/letter/h/e68b1a/32.png) [@hoggle](https://discuss.elastic.co/u/hoggle)\ **Post date:** [September 24, 2019, 6:39am UTC](https://discuss.elastic.co/t/logstash-behaves-like-a-portscanner/200797/1 "2019-09-24T06:39:33Z")
Hi there, our firewall monitoring has identified the logstash process behaving very weird: The java process connects to another machine on about 230 different TCP Ports. So basically it behaves like a portscanner. The people who have installed logstash don't know how to identify the root cause for this. Here is an example from tcpdump: 10.x.x.22.commplex-main \> 10.x.x.57.60230: Flags [S.], cksum 0x1c0d (incorrect -\> 0x6cda), seq 2703440304, ack 3314038781, win 28960, options [mss 1460,sackOK,TS val 1216153208 ecr 1678754793,nop,wscale 7], length 0 08:34:55.604342 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) This is outgoing traffic from the logstash process on Source Port TCP 5000. If i stop the filebeat service on the target machine there is no bad traffic anymore. Can anybody explain me the background of this traffic and/or how to stop it. Thanks in advance. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 22, 2019, 6:39am UTC](https://discuss.elastic.co/t/logstash-behaves-like-a-portscanner/200797/2 "2019-10-22T06:39:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.