Winfreez DoS question

["Glenn Pitcher" <gpitcher () sandiego edu>]

We recently setup a snort server here on campus and last night it appears
that someone just outside our production firewall, probably on our student
computing network, launched a ICMP host redirect attack against an HP
OpenView system - most probably using Winfreez. However, the logs show the
attack coming from multiple addresses all on 10.13.0.0/16 cycling from
10.13.0.1 upwards using five unique IPs at a time. I just wanted to know if
anyone has ever seen anything similar to this so I know I'm not going crazy.

I'll include some of the log output but if anyone needs more info, drop me a
line.

TIA

Glenn Pitcher
System Administrator
University of San Diego
gpitcher () sandiego edu
(619) 260-7571

-------------------
04/25/2002 00:23:17.764138 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.1 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.1: icmp: echo request (ttl 126, id
38819, len 84) (ttl 128, id 63088, len 56)
04/25/2002 00:23:17.773256 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 126, id
39075, len 84) (ttl 128, id 63344, len 56)
04/25/2002 00:23:17.774036 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 126, id
39331, len 84) (ttl 128, id 63600, len 56)
04/25/2002 00:23:17.775040 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 126, id
39587, len 84) (ttl 128, id 63856, len 56)
04/25/2002 00:23:17.776053 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.5 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.5: icmp: echo request (ttl 126, id
39843, len 84) (ttl 128, id 64112, len 56)
04/25/2002 00:23:17.778631 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.1 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.1: icmp: echo request (ttl 124, id
38819, len 84) (ttl 128, id 64368, len 56)
04/25/2002 00:23:17.779633 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.6 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.6: icmp: echo request (ttl 126, id
40099, len 84) (ttl 128, id 64624, len 56)
04/25/2002 00:23:17.787865 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 124, id
39075, len 84) (ttl 128, id 64880, len 56)
04/25/2002 00:23:17.788629 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 124, id
39331, len 84) (ttl 128, id 65136, len 56)
04/25/2002 00:23:17.789626 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 124, id
39587, len 84) (ttl 128, id 65392, len 56)
04/25/2002 00:23:17.790622 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.5 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.5: icmp: echo request (ttl 124, id
39843, len 84) (ttl 128, id 113, len 56)
04/25/2002 00:23:17.793322 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.1 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.1: icmp: echo request (ttl 122, id
38819, len 84) (ttl 128, id 369, len 56)
04/25/2002 00:23:17.794318 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.6 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.6: icmp: echo request (ttl 124, id
40099, len 84) (ttl 128, id 625, len 56)
04/25/2002 00:23:17.802735 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 122, id
39075, len 84) (ttl 128, id 881, len 56)
04/25/2002 00:23:17.803511 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 122, id
39331, len 84) (ttl 128, id 1137, len 56)
04/25/2002 00:23:17.804505 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 122, id
39587, len 84) (ttl 128, id 1393, len 56)
04/25/2002 00:23:17.805501 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.5 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.5: icmp: echo request (ttl 122, id
39843, len 84) (ttl 128, id 1649, len 56)
04/25/2002 00:23:17.808560 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.1 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.1: icmp: echo request (ttl 120, id
38819, len 84) (ttl 128, id 1905, len 56)
04/25/2002 00:23:17.809555 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.6 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.6: icmp: echo request (ttl 122, id
40099, len 84) (ttl 128, id 2161, len 56)
04/25/2002 00:23:17.818663 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 120, id
39075, len 84) (ttl 128, id 2417, len 56)
04/25/2002 00:23:17.819439 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 120, id
39331, len 84) (ttl 128, id 2673, len 56)
04/25/2002 00:23:17.820433 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 120, id
39587, len 84) (ttl 128, id 2929, len 56)
04/25/2002 00:23:17.821427 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.5 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.5: icmp: echo request (ttl 120, id
39843, len 84) (ttl 128, id 3185, len 56)
04/25/2002 00:23:17.824148 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.1 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.1: icmp: echo request (ttl 118, id
38819, len 84) (ttl 128, id 3441, len 56)
04/25/2002 00:23:17.825144 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.6 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.6: icmp: echo request (ttl 120, id
40099, len 84) (ttl 128, id 3697, len 56)
04/25/2002 00:23:17.833361 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 118, id
39075, len 84) (ttl 128, id 3953, len 56)
04/25/2002 00:23:17.834134 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 118, id
39331, len 84) (ttl 128, id 4209, len 56)
04/25/2002 00:23:17.835134 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.4 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.4: icmp: echo request (ttl 118, id
39587, len 84) (ttl 128, id 4465, len 56)
04/25/2002 00:23:17.836129 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.5 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.5: icmp: echo request (ttl 118, id
39843, len 84) (ttl 128, id 4721, len 56)
04/25/2002 00:23:17.838748 0:60:8:a:69:c1 0:60:8:93:91:c8 ip 70:
xxx.xxx.173.2 > xxx.xxx.173.8: icmp: redirect 10.13.0.1 to host
xxx.xxx.173.1 for xxx.xxx.173.8 > 10.13.0.1: icmp: echo request (ttl 116, id
38819, len 84) (ttl 128, id 4977, len 56)


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com