R: [Pinguzilla] Weird Traffic

["Vega - Brunello Ivan" <I.Brunello () vegaspa it>]

Definitely an outbound connection

 value="52FC3B9C" showvalue="82.252.59.156" /> <field name="dst" longname="Destination address" size="4" pos="30"

On most firewall I know, applying a rule does not interrupt an active session.
I'd first reset all sessions, and then recheck firewall rules are correctly applied.
Next, change firewall/filtering tecnology.



Ivan Brunello
 

-----Messaggio originale-----
Da: Jonathan Adams [mailto:keirre.adams () gmail com] 
Inviato: mercoledì 28 maggio 2008 23.16
A: John Duksta
Cc: incidents () securityfocus com
Oggetto: Re: [Pinguzilla] Weird Traffic

Well... I got the results of an 11hr TCPDUMP run.. and it shows...
NOTHING.. a couple of probes, lots of network traffic (router messages, ARP requests, Windows NETBIOS noise from my 
ISP's lan) only got a few probes today... apparently the FW rules shut down most of the traffic for now.

What is weird is this: my ipfw has this

07700 deny log ip from 82.0.0.0/8 to any 07800 deny log ip from any to 82.0.0.0/8



yet the TCP dump shows this:

<pdml>
<packet>
<proto name="geninfo" longname="General information" pos="0" size="66"> <field name="num" longname="Number" 
showvalue="117" value="117"
pos="0" size="66"/>
<field name="linklayer" longname="Link Layer" showvalue="1" value="1"
showmap="Ethernet" pos="0" size="66"/>
<field name="len" longname="Packet Length" showvalue="66" value="66"
pos="0" size="66"/>
<field name="caplen" longname="Captured Length" showvalue="66"
value="66" pos="0" size="66"/>
<field name="timestamp" longname="Captured Time"
showvalue="09:44:09.621223" value="1211982249.621223" pos="0"
size="66"/>
</proto>
<proto name="ethernet" longname="Ethernet 802.3" pos="0" size="14"> <field name="dst" longname="MAC Destination" 
size="6" pos="0"
value="000D6103491A" showvalue="000D61-03491A" showdtl="000D61-03491A (Unicast address, vendor code not available)" 
showmap="code not available" /> <field name="src" longname="MAC Source" size="6" pos="6"
value="00D00247B3FC" showvalue="00D002-47B3FC" showdtl="00D002-47B3FC (Unicast address, vendor code not available)" 
showmap="code not available" /> <field name="type" longname="Ethertype - Length" size="2" pos="12"
value="0800" showvalue="2048" showdtl="0x0800 (Ethertype)" /> </proto> <proto name="ip" longname="IPv4 (Internet 
Protocol version 4)"
pos="14" size="20">
<field name="ver" longname="Version" size="1" pos="14" value="45"
mask="f0" showvalue="4" />
<field name="hlen" longname="Header length" size="1" pos="14"
value="45" mask="0f" showvalue="5" showdtl="20 (field value = 5)" /> <field name="tos" longname="Type of service" 
size="1" pos="15"
value="00" showvalue="0x00" />
<field name="tlen" longname="Total length" size="2" pos="16"
value="0034" showvalue="52" />
<field name="identification" longname="Identification" size="2"
pos="18" value="3612" showvalue="13842" /> <field name="ffo" longname="Flags and Fragment offset" size="2" pos="20" > 
<field name="unused" longname="Unused" size="2" pos="20" value="4000"
mask="8000" showvalue="0b0..............." /> <field name="df" longname="Don't fragment" size="2" pos="20"
value="4000" mask="4000" showvalue="0b.1.............." /> <field name="mf" longname="More fragments" size="2" pos="20"
value="4000" mask="2000" showvalue="0b..0............." /> <field name="foffset" longname="Fragment offset" size="2" 
pos="20"
value="4000" mask="1fff" showvalue="0" showdtl="0 (field value = 0)"
/>
</field>
<field name="ttl" longname="Time to live" size="1" pos="22" value="38"
showvalue="56" />
<field name="nextp" longname="Next protocol" size="1" pos="23"
value="06" showvalue="6" />
<field name="hchecksum" longname="Header Checksum" size="2" pos="24"
value="452F" showvalue="0x452F" />
<field name="src" longname="Source address" size="4" pos="26"
value="52FC3B9C" showvalue="82.252.59.156" /> <field name="dst" longname="Destination address" size="4" pos="30"
value="4224F6C6" showvalue="66.36.246.198" /> </proto> <proto name="tcp" longname="TCP (Transmission Control Protocol)"
pos="34" size="32">
<field name="sport" longname="Source port" size="2" pos="34"
value="0D7D" showvalue="3453" />
<field name="dport" longname="Destination port" size="2" pos="36"
value="0050" showvalue="80" />
<field name="seq" longname="Sequence number" size="4" pos="38"
value="B20A5764" showvalue="2987022180" /> <field name="ack" longname="Acknowledgement Number" size="4" pos="42"
value="00000000" showvalue="0" />
<field name="hlen" longname="Header length" size="2" pos="46"
value="8002" mask="f000" showvalue="8" showdtl="32 (field value = 8)"
/>
<field name="res" longname="Reserved (must be zero)" size="2" pos="46"
value="8002" mask="0fc0" showvalue="0x0000" /> <field name="flags" longname="Flags" size="2" pos="46" value="8002"
mask="003f" showvalue="0x0002" >
<field name="urg" longname="Urgent pointer" size="2" pos="46"
value="8002" mask="0020" showvalue="0b..........0....." /> <field name="ackf" longname="Ack valid" size="2" pos="46" 
value="8002"
mask="0010" showvalue="0b...........0...." /> <field name="push" longname="Push requested" size="2" pos="46"
value="8002" mask="0008" showvalue="0b............0..." /> <field name="rst" longname="Reset requested" size="2" 
pos="46"
value="8002" mask="0004" showvalue="0b.............0.." /> <field name="syn" longname="Syn requested" size="2" pos="46"
value="8002" mask="0002" showvalue="0b..............1." /> <field name="fin" longname="Fin requested" size="2" pos="46"
value="8002" mask="0001" showvalue="0b...............0" /> </field> <field name="win" longname="Window size" size="2" 
pos="48"
value="FFFF" showvalue="65535" />
<field name="crc" longname="Checksum" size="2" pos="50" value="9085"
showvalue="0x9085" />
<field name="urg" longname="Urgent Pointer" size="2" pos="52"
value="0000" showvalue="0x0000" />
<field name="options" longname="TCP Options" size="12" pos="54" > <field name="mss" longname="Maximum Segment Size" 
size="4" pos="54" > <field name="type" longname="Type" size="1" pos="54" value="02" showvalue="2" /> <field 
name="length" longname="Option length" size="1" pos="55"
value="04" showvalue="4" />
<field name="maxssize" longname="Maximum Segment Size" size="2"
pos="56" value="0584" showvalue="1412" /> </field> <field name="noperation" longname="No Operation" size="1" pos="58" > 
<field name="type" longname="Type" size="1" pos="58" value="01" showvalue="1" /> </field> <field name="winscale" 
longname="TCP Windows Scale Option" size="3" pos="59" > <field name="type" longname="Type" size="1" pos="59" value="03" 
showvalue="3" /> <field name="length" longname="Option Length" size="1" pos="60"
value="03" showvalue="3" />
<field name="shift.cnt" longname="Shift Count" size="1" pos="61"
value="04" showvalue="4" />
</field>
<field name="noperation" longname="No Operation" size="1" pos="62" > <field name="type" longname="Type" size="1" 
pos="62" value="01" showvalue="1" /> </field> <field name="noperation" longname="No Operation" size="1" pos="63" > 
<field name="type" longname="Type" size="1" pos="63" value="01" showvalue="1" /> </field> <field name="sackpermitted" 
longname="Sack-Permitted Option" size="2" pos="64" > <field name="type" longname="Type" size="1" pos="64" value="04" 
showvalue="4" /> <field name="length" longname="Option Length" size="1" pos="65"
value="02" showvalue="2" />
</field>
</field>
</proto>
</packet></pdml>



On Wed, May 28, 2008 at 5:20 AM, Jonathan Adams <keirre.adams () gmail com> wrote:
> John,
>
>  I am running late for my real job :) but when i come back Ill run 
> some more test and post the results.
>
> BTW, 1.5 GB transferred yesterday. there is no way this is valid web 
> or ftp traffic...  something is proxying through my box...
>
> Im sure of it
>
> On Tue, May 27, 2008 at 11:06 PM, John Duksta <john () duksta org> wrote:
> > Jonathan,
> >
> > I'd be curious to get a copy of the list of networks that you're 
> > seeing this traffic from. I work for a large managed security service 
> > provider and I could cross reference these networks against data that 
> > we're seeing from our corporate customers.
> >
> > Regards,
> > -john
> >
> >
> > On May 27, 2008, at 7:59 AM, Jonathan Adams wrote:
> >
> > > All,
> > >
> > >  I have a leased server I use to host some websites and for the past 
> > > week I have been getting traffic warnings. The server has been 
> > > transferring > 1GB of data per day, which is unusually high, 
> > > especially since I moved my mail to Google Apps. I have noticed a 
> > > ridiculous amount of attempted proxying attemptes in my logs, but I 
> > > do not have mod proxy turned on. I suspect my server is on some 
> > > list.  I firewalled off a large number of subnets from China and my 
> > > traffic dropped for a few days, then this morning, 2735MB 
> > > transferred in 24 hrs.
> > >
> > >  As of right now, I am planning to blackhole all China traffic, 
> > > since thats where most of this is comming from, along with the 
> > > occasional traffic from France and other places in Eur. Is this 
> > > common?  If so are there any other remedies?
> > >
> > > --
> > >
> > > "Strength does not come from physical capacity. It comes from an 
> > > indomitable will." - Mohandas Gandhi
> > >
> > > _______________________________________________
> > > Pinguzilla mailing list
> > > Pinguzilla () as220 org
> > > http://www.as220.org/mailman/listinfo/pinguzilla
>
>
>
> --
> ___________________________
> Jon Adams
>
> web: http://www.scis.nova.edu/~jonaadam
> mail: keirre.adams () gmail com
> ---------------------------------------------
>
> "Strength does not come from physical capacity. It comes from an 
> indomitable will." - Mohandas Gandhi



-- 
___________________________
Jon Adams

web: http://www.scis.nova.edu/~jonaadam
mail: keirre.adams () gmail com
---------------------------------------------

"Strength does not come from physical capacity. It comes from an
indomitable will." -
Mohandas Gandhi