Re: Port 7000 (Apple File Share) DoS/DDoS underway

[Jonathan Nichols <jnichols () pbp net>]

David Gillett wrote:

>   A handful of machines, nowhere near me (network prefixes
> 218, 211, and 61) seem to be sending a mix of SYN-ACK and
> RST packets, all with a source port of 7000, to assorted
> (random) addresses in my public Class B range.
>
>   I expect this means that someone is spoofing random source
> addresses -- many of them in my range, but who knows how many
> in others... -- and ports and SYN-flooding those half-dozen
> machines.
>
>   So far, reverse DNS and traceroute haven't helped me identify
> the victims.

Apple File Protocol is actually port 548, not port 7000.

If I recall correctly, afs3 is a NFS like file system by IBM.. but it's 
not by Apple. :)

-Jonathan