Hey Joe,
Hmmm... There's a good chance it's a standard QOTD (Quote of the Day)
portscan based on the fact they're all destined for port 17. While it's
not a truly "compromising" sort of vulnerability if exploited, it can
still reek some havoc on the network. Good thing your firewall's
dropping it. >;)
Here's a link that'll give you more info.
http://www.networkscanning.com/Quote-of-the-day-VSS_10198.html
Regards,
Jason Ha [CISSP]
Senior Security Engineer,
Security Operations Centre
VeriSign Australia
_____
From: Joe Grinnell [mailto:joe.grinnell@axisci.com]
Sent: Wednesday, 17 November 2004 6:59 AM
To: firewalls@securityfocus.com
Subject: Fragmented Packet
Hi, I'm pretty new to firewalls and have just installed a SonicWALL
Pro230 with all the default settings. Anyway, I'm starting to see a lot
of activity to a few different PC's in my DMZ from the below source.
Anyone know what the heck is going on here? Any help would be very much
appreciated.
11/16/2004 03:05:46.816 - Fragmented Packet Dropped - Source:
83.102.166.24, 17, WAN - Destination: XXX.XXX.XXX.XXX, DMZ - Protocol:
17 -
11/16/2004 03:08:46.816 - Fragmented Packet Dropped - Source:
83.102.166.53, 17, WAN - Destination: XXX.XXX.XXX.XXX, DMZ - Protocol:
17 -
11/16/2004 03:16:46.816 - Fragmented Packet Dropped - Source:
83.102.166.84, 17, WAN - Destination: XXX.XXX.XXX.XXX, DMZ - Protocol:
17 -
11/16/2004 03:23:46.816 - Fragmented Packet Dropped - Source:
83.102.166.204, 17, WAN - Destination: XXX.XXX.XXX.XXX, DMZ - Protocol:
17 -
Thanks in advance. I really need to get my learn on.
Joe Grinnell
network security wannabe
