Security Incidents mailing list archives
UDP echo packets from 1 dec until present
From: Jose Nazario <jose () BIOCSERVER BIOC CWRU EDU>
Date: Wed, 6 Dec 2000 12:46:59 -0500
hi all, i've been receiving a handful of UDP echo packets on an email server since december 1, consistently from the same IP address. so far it hasn't caused any performance problems (ie no floods), and they're being blocked. i'm at a loss, though, to figure out why this trickle of packets would be found. it does't make sense from a Firewalk point of view, as most sites block echo (both tcp and udp) on their borders. it doesn't make sense from the standpoint of detecting hosts, either, for that very reason. and the trickle seems like a very poorly done DDoS, which seems to rule that out (unless we assume super stupid attackers). any input would be welcome. these are the only connections i have from that IP (from xinetd logs): 00/12/1@10:44:08: FAIL: echo-dgram address from=169.254.97.28 00/12/1@11:54:48: FAIL: echo-dgram address from=169.254.97.28 00/12/1@14:59:32: FAIL: echo-dgram address from=169.254.97.28 00/12/1@15:09:58: FAIL: echo-dgram address from=169.254.97.28 00/12/1@15:54:13: FAIL: echo-dgram address from=169.254.97.28 00/12/1@16:09:54: FAIL: echo-dgram address from=169.254.97.28 00/12/1@16:54:42: FAIL: echo-dgram address from=169.254.97.28 00/12/1@18:14:09: FAIL: echo-dgram address from=169.254.97.28 00/12/2@10:13:35: FAIL: echo-dgram address from=169.254.97.28 00/12/2@10:20:29: FAIL: echo-dgram address from=169.254.97.28 00/12/2@11:37:33: FAIL: echo-dgram address from=169.254.97.28 00/12/2@16:14:34: FAIL: echo-dgram address from=169.254.97.28 00/12/2@21:03:30: FAIL: echo-dgram address from=169.254.97.28 00/12/3@15:49:36: FAIL: echo-dgram address from=169.254.97.28 00/12/4@09:07:02: FAIL: echo-dgram address from=169.254.97.28 00/12/4@09:17:13: FAIL: echo-dgram address from=169.254.97.28 00/12/4@13:41:22: FAIL: echo-dgram address from=169.254.97.28 00/12/5@08:06:59: FAIL: echo-dgram address from=169.254.97.28 00/12/5@09:55:35: FAIL: echo-dgram address from=169.254.97.28 00/12/5@11:37:08: FAIL: echo-dgram address from=169.254.97.28 00/12/5@12:25:36: FAIL: echo-dgram address from=169.254.97.28 00/12/5@13:00:57: FAIL: echo-dgram address from=169.254.97.28 00/12/5@13:15:30: FAIL: echo-dgram address from=169.254.97.28 00/12/5@15:42:36: FAIL: echo-dgram address from=169.254.97.28 ____________________________ jose nazario jose () cwru edu PGP: 89 B0 81 DA 5B FD 7E 00 99 C3 B2 CD 48 A0 07 80 PGP key ID 0xFD37F4E5 (pgp.mit.edu)
Current thread:
- UDP echo packets from 1 dec until present Jose Nazario (Dec 09)
- Re: UDP echo packets from 1 dec until present Crist Clark (Dec 11)
- Re: UDP echo packets from 1 dec until present Sean Brown (Dec 11)
- <Possible follow-ups>
- Re: UDP echo packets from 1 dec until present Robert G. Ferrell (Dec 11)