Re: DDoS attack.

["Daniel F. Chief Security Engineer -" <danielf () supportteam net>]

Thanks for every ones help. 

the -e is what I was missing to get this guy. 

thanks again. 


On Friday 25 January 2002 01:04 pm, Glenn Forbes Fleming Larratt wrote:
> A "tcpdump -ner" will show you the MAC address or addresses your tcpdump
> host sees for this traffic. That address or addresses will either belong
> to the source host, or a core router through which it came.
>
> If it's a router, you'll need to trace back to which network on the
> other side of it, and iterate as necessary. A portable tcpdump host
> would come in handy to do so.
>
> If it's a Cisco router, you might look into deploying the per-interface
> command "ip verify unicast reverse-path" (I think - I may have
> misremembered the syntax), which automatically prevents spoofing beyond the
> scope of the LAN segment. Check this command out at www.cisco.com .
>
>       -g
>
> On Fri, 25 Jan 2002, Daniel F. Chief Security Engineer - wrote:
> > Date: Fri, 25 Jan 2002 12:23:26 -0600
> > From: Daniel F. Chief Security Engineer - <danielf () supportteam net>
> > To: incidents () securityfocus com
> > Subject: DDoS attack.
> >
> > Im looking for help tracing this attack down. Its coming from my network
> > with spoofed IPs to 216.200.108.194 IP which is not on my network so its
> > and outbound attack. Also none of the source IPs are on my network.
> >
> > I have blocked the outgoing traffic at the firewalls so it is not leaving
> > my network.
> >
> > Here is a short tcpdump if the traffic.
> > 11:34:50.660747 43.150.52.83.24630 > 216.200.108.194.5371: S
> > 1667351577:1667351577(0) win 65535
> > 11:34:50.661041 54.216.84.23.29249 > 216.200.108.194.5372: S
> > 1116047630:1116047630(0) win 65535
> > 11:34:50.661420 255.8.148.250.22903 > 216.200.108.194.5377: S
> > 2101768472:2101768472(0) win 65535
> > 11:34:50.661762 226.66.36.238.2498 > 216.200.108.194.5378: S
> > 1399051237:1399051237(0) win 65535
> > 11:34:50.661910 98.139.159.60.41527 > 216.200.108.194.5379: S
> > 417777474:417777474(0) win 65535
> >
> > It got all the signs of a dDoS attack window size is always the same dst
> > ports are incrementing by one every time. and the source IP is
> > randomized. I cannot fine the machine(s) that are generating this as I
> > have a very large interconnected(cluster $#@!) network that inherited
> > which comatins well over 1600 hosts.
> >
> > TIA
>
>                               Glenn Forbes Fleming Larratt
>                               Rice University Network Management
>                               glratt () rice edu
>
>
> ---------------------------------------------------------------------------
> - This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com

-- 
Chief Security Engineer | Daniel Fairchild danielf () supportteam net
Unix is like a wigwam -- no Gates, no Windows, and an Apache inside.



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com