Definitely an outbound connection
value="52FC3B9C" showvalue="82.252.59.156" /> <field name="dst"
longname="Destination address" size="4" pos="30"
On most firewall I know, applying a rule does not interrupt an active session.
I'd first reset all sessions, and then recheck firewall rules are correctly
applied.
Next, change firewall/filtering tecnology.
Ivan Brunello
-----Messaggio originale-----
Da: Jonathan Adams [mailto:keirre.adams@gmail.com]
Inviato: mercoledì 28 maggio 2008 23.16
A: John Duksta
Cc: incidents@securityfocus.com
Oggetto: Re: [Pinguzilla] Weird Traffic
Well... I got the results of an 11hr TCPDUMP run.. and it shows...
NOTHING.. a couple of probes, lots of network traffic (router messages, ARP
requests, Windows NETBIOS noise from my ISP's lan) only got a few probes
today... apparently the FW rules shut down most of the traffic for now.
What is weird is this: my ipfw has this
07700 deny log ip from 82.0.0.0/8 to any 07800 deny log ip from any to
82.0.0.0/8
yet the TCP dump shows this:
<pdml>
<packet>
<proto name="geninfo" longname="General information" pos="0" size="66"> <field
name="num" longname="Number" showvalue="117" value="117"
pos="0" size="66"/>
<field name="linklayer" longname="Link Layer" showvalue="1" value="1"
showmap="Ethernet" pos="0" size="66"/>
<field name="len" longname="Packet Length" showvalue="66" value="66"
pos="0" size="66"/>
<field name="caplen" longname="Captured Length" showvalue="66"
value="66" pos="0" size="66"/>
<field name="timestamp" longname="Captured Time"
showvalue="09:44:09.621223" value="1211982249.621223" pos="0"
size="66"/>
</proto>
<proto name="ethernet" longname="Ethernet 802.3" pos="0" size="14"> <field
name="dst" longname="MAC Destination" size="6" pos="0"
value="000D6103491A" showvalue="000D61-03491A" showdtl="000D61-03491A (Unicast
address, vendor code not available)" showmap="code not available" /> <field
name="src" longname="MAC Source" size="6" pos="6"
value="00D00247B3FC" showvalue="00D002-47B3FC" showdtl="00D002-47B3FC (Unicast
address, vendor code not available)" showmap="code not available" /> <field
name="type" longname="Ethertype - Length" size="2" pos="12"
value="0800" showvalue="2048" showdtl="0x0800 (Ethertype)" /> </proto> <proto
name="ip" longname="IPv4 (Internet Protocol version 4)"
pos="14" size="20">
<field name="ver" longname="Version" size="1" pos="14" value="45"
mask="f0" showvalue="4" />
<field name="hlen" longname="Header length" size="1" pos="14"
value="45" mask="0f" showvalue="5" showdtl="20 (field value = 5)" /> <field
name="tos" longname="Type of service" size="1" pos="15"
value="00" showvalue="0x00" />
<field name="tlen" longname="Total length" size="2" pos="16"
value="0034" showvalue="52" />
<field name="identification" longname="Identification" size="2"
pos="18" value="3612" showvalue="13842" /> <field name="ffo" longname="Flags
and Fragment offset" size="2" pos="20" > <field name="unused" longname="Unused"
size="2" pos="20" value="4000"
mask="8000" showvalue="0b0..............." /> <field name="df" longname="Don't
fragment" size="2" pos="20"
value="4000" mask="4000" showvalue="0b.1.............." /> <field name="mf"
longname="More fragments" size="2" pos="20"
value="4000" mask="2000" showvalue="0b..0............." /> <field
name="foffset" longname="Fragment offset" size="2" pos="20"
value="4000" mask="1fff" showvalue="0" showdtl="0 (field value = 0)"
/>
</field>
<field name="ttl" longname="Time to live" size="1" pos="22" value="38"
showvalue="56" />
<field name="nextp" longname="Next protocol" size="1" pos="23"
value="06" showvalue="6" />
<field name="hchecksum" longname="Header Checksum" size="2" pos="24"
value="452F" showvalue="0x452F" />
<field name="src" longname="Source address" size="4" pos="26"
value="52FC3B9C" showvalue="82.252.59.156" /> <field name="dst"
longname="Destination address" size="4" pos="30"
value="4224F6C6" showvalue="66.36.246.198" /> </proto> <proto name="tcp"
longname="TCP (Transmission Control Protocol)"
pos="34" size="32">
<field name="sport" longname="Source port" size="2" pos="34"
value="0D7D" showvalue="3453" />
<field name="dport" longname="Destination port" size="2" pos="36"
value="0050" showvalue="80" />
<field name="seq" longname="Sequence number" size="4" pos="38"
value="B20A5764" showvalue="2987022180" /> <field name="ack"
longname="Acknowledgement Number" size="4" pos="42"
value="00000000" showvalue="0" />
<field name="hlen" longname="Header length" size="2" pos="46"
value="8002" mask="f000" showvalue="8" showdtl="32 (field value = 8)"
/>
<field name="res" longname="Reserved (must be zero)" size="2" pos="46"
value="8002" mask="0fc0" showvalue="0x0000" /> <field name="flags"
longname="Flags" size="2" pos="46" value="8002"
mask="003f" showvalue="0x0002" >
<field name="urg" longname="Urgent pointer" size="2" pos="46"
value="8002" mask="0020" showvalue="0b..........0....." /> <field name="ackf"
longname="Ack valid" size="2" pos="46" value="8002"
mask="0010" showvalue="0b...........0...." /> <field name="push" longname="Push
requested" size="2" pos="46"
value="8002" mask="0008" showvalue="0b............0..." /> <field name="rst"
longname="Reset requested" size="2" pos="46"
value="8002" mask="0004" showvalue="0b.............0.." /> <field name="syn"
longname="Syn requested" size="2" pos="46"
value="8002" mask="0002" showvalue="0b..............1." /> <field name="fin"
longname="Fin requested" size="2" pos="46"
value="8002" mask="0001" showvalue="0b...............0" /> </field> <field
name="win" longname="Window size" size="2" pos="48"
value="FFFF" showvalue="65535" />
<field name="crc" longname="Checksum" size="2" pos="50" value="9085"
showvalue="0x9085" />
<field name="urg" longname="Urgent Pointer" size="2" pos="52"
value="0000" showvalue="0x0000" />
<field name="options" longname="TCP Options" size="12" pos="54" > <field
name="mss" longname="Maximum Segment Size" size="4" pos="54" > <field
name="type" longname="Type" size="1" pos="54" value="02" showvalue="2" />
<field name="length" longname="Option length" size="1" pos="55"
value="04" showvalue="4" />
<field name="maxssize" longname="Maximum Segment Size" size="2"
pos="56" value="0584" showvalue="1412" /> </field> <field name="noperation"
longname="No Operation" size="1" pos="58" > <field name="type" longname="Type"
size="1" pos="58" value="01" showvalue="1" /> </field> <field name="winscale"
longname="TCP Windows Scale Option" size="3" pos="59" > <field name="type"
longname="Type" size="1" pos="59" value="03" showvalue="3" /> <field
name="length" longname="Option Length" size="1" pos="60"
value="03" showvalue="3" />
<field name="shift.cnt" longname="Shift Count" size="1" pos="61"
value="04" showvalue="4" />
</field>
<field name="noperation" longname="No Operation" size="1" pos="62" > <field
name="type" longname="Type" size="1" pos="62" value="01" showvalue="1" />
</field> <field name="noperation" longname="No Operation" size="1" pos="63" >
<field name="type" longname="Type" size="1" pos="63" value="01" showvalue="1"
/> </field> <field name="sackpermitted" longname="Sack-Permitted Option"
size="2" pos="64" > <field name="type" longname="Type" size="1" pos="64"
value="04" showvalue="4" /> <field name="length" longname="Option Length"
size="1" pos="65"
value="02" showvalue="2" />
</field>
</field>
</proto>
</packet></pdml>
On Wed, May 28, 2008 at 5:20 AM, Jonathan Adams <keirre.adams@gmail.com> wrote:
John,
I am running late for my real job :) but when i come back Ill run
some more test and post the results.
BTW, 1.5 GB transferred yesterday. there is no way this is valid web
or ftp traffic... something is proxying through my box...
Im sure of it
On Tue, May 27, 2008 at 11:06 PM, John Duksta <john@duksta.org> wrote:
Jonathan,
I'd be curious to get a copy of the list of networks that you're
seeing this traffic from. I work for a large managed security service
provider and I could cross reference these networks against data that
we're seeing from our corporate customers.
Regards,
-john
On May 27, 2008, at 7:59 AM, Jonathan Adams wrote:
All,
I have a leased server I use to host some websites and for the past
week I have been getting traffic warnings. The server has been
transferring > 1GB of data per day, which is unusually high,
especially since I moved my mail to Google Apps. I have noticed a
ridiculous amount of attempted proxying attemptes in my logs, but I
do not have mod proxy turned on. I suspect my server is on some
list. I firewalled off a large number of subnets from China and my
traffic dropped for a few days, then this morning, 2735MB
transferred in 24 hrs.
As of right now, I am planning to blackhole all China traffic,
since thats where most of this is comming from, along with the
occasional traffic from France and other places in Eur. Is this
common? If so are there any other remedies?
--
"Strength does not come from physical capacity. It comes from an
indomitable will." - Mohandas Gandhi
_______________________________________________
Pinguzilla mailing list
Pinguzilla@as220.org
http://www.as220.org/mailman/listinfo/pinguzilla
--
___________________________
Jon Adams
web: http://www.scis.nova.edu/~jonaadam
mail: keirre.adams@gmail.com
---------------------------------------------
"Strength does not come from physical capacity. It comes from an
indomitable will." - Mohandas Gandhi
--
___________________________
Jon Adams
web: http://www.scis.nova.edu/~jonaadam
mail: keirre.adams@gmail.com
---------------------------------------------
"Strength does not come from physical capacity. It comes from an
indomitable will." -
Mohandas Gandhi
