Re: Odd Increase in Malformed Packets Aimed at Port 0

["Steve Porter" <crusher () naisp net>]

These are happening on Windows networks, with SonicWall firewalls, but I'll 
see what I can cobble together to get more detailed packet info.  I'm pretty 
sure this is indicative of some new virus/exploit or something along those 
lines, simply due to the sheer volume of these alerts I've been getting. 
They started at home, on a cablemodem system, and then slowly they began 
popping up at work as well, two completely unrelated networks.

When I'm able to get something along the lines of a tcpdump (or equiv), I'll 
post here.

Thanks,

- Steve -

----- Original Message ----- 
From: "Jose Nazario" <jose () monkey org>
To: <crusher () spamcop net>
Cc: <incidents () securityfocus com>
Sent: Wednesday, October 19, 2005 12:03 PM
Subject: Re: Odd Increase in Malformed Packets Aimed at Port 0


> could be fragmented traffic. can you secure a tcpdump log of the traffic?
> that will reveal more attributes of the traffic than the firewall logs
> you shared.
>
> another poster here was discussing a recent spike in fragmented UDP
> traffic, too.
>
> ________
> jose nazario, ph.d. jose () monkey org
> http://monkey.org/~jose/ http://infosecdaily.net/
> http://www.wormblog.com/