Interesting scanning activity

[George Bakos <alpinista () BIGFOOT COM>]

Here's a very curious bit.  At first we see just a horizontal ping sequence
followed by a good ol'  ACK scan, but take a close look at the packets headed
for good.guys.net.164.  The IP total lengths (ip[2:2]) are the minimum for all
the ICMP echo and TCP ACK packets, 0x1c and 0x28 respecively, and should have a
bunch of zeros following.  However, we see the same non-zero data in both
packets headed for host 164!  Normally, the frame will be padded with  zeros
to a minimum of 46 bytes.  Any ideas?

18:07:21.744074 63.98.234.3 > good.guys.net.162: icmp: echo request
                         4500 001c 27ea 0000 1e01 1329 3f62 ea03
                         **** 66a2 0800 923f 3bbd 2a03 0000 0000
                         0000 0000 0000 0000 0000 0000 0000
18:07:21.755475 63.98.234.3.62287 > good.guys.net.162.80: . ack 603481715 win 3072
                         4500 0028 9f38 0000 2306 96c9 3f62 ea03
                         **** 66a2 f34f 0050 f6d8 1953 23f8 6673
                         5010 0c00 b3ce 0000 0000 0000 0000
18:07:21.760565 63.98.234.3 > good.guys.net.163: icmp: echo request
                         4500 001c 70ac 0000 1e01 ca65 3f62 ea03
                         **** 66a3 0800 8d3f 3bbd 2f03 23f8 6673
                         5010 0c00 b3ce 0000 0000 0000 0000
18:07:21.769549 63.98.234.3 > good.guys.net.164: icmp: echo request
                         4500 001c a01c 0000 1e01 9af4 3f62 ea03
                         **** 66a4 0800 883f 3bbd 3403 c37a 0000
                         0001 0000 0000 0000 0133 0332 3334
18:07:21.772458 63.98.234.3.62287 > good.guys.net.163.80: . ack 1956327536 win 3072
                         4500 0028 59ff 0000 2306 dc01 3f62 ea03
                         **** 66a3 f34f 0050 5d00 197b 749b 3070
                         5010 0c00 32de 0000 0133 0332 3334
18:07:21.779242 63.98.234.3.62287 > good.guys.net.164.80: . ack 3516791285 win 3072
                         4500 0028 2729 0000 2306 0ed7 3f62 ea03
                         **** 66a4 f34f 0050 45d8 19a3 d19d f9f5
                         5010 0c00 2355 0000 0133 0332 3334
18:07:21.834059 63.98.234.3 > good.guys.net.170: icmp: echo request
                         4500 001c 0433 0000 1e01 36d8 3f62 ea03
                         **** 66aa 0800 6a3f 3bbd 5203 0000 0000
                         0000 0000 0000 0000 0000 0000 0000
18:07:21.850528 63.98.234.3.62287 > good.guys.net.170.80: . ack 2525377762 win 3072
                         4500 0028 652e 0000 2306 d0cb 3f62 ea03
                         **** 66aa f34f 0050 3b60 1a93 9686 34e2
                         5010 0c00 2d02 0000 0000 0000 0000
18:07:23.018446 63.98.234.3 > good.guys.net.180: icmp: echo request
                         4500 001c b059 0000 1e01 8aa7 3f62 ea03
                         **** 66b4 0800 383f 3bbd 8403 0000 0000
                         0000 0000 0000 0000 0000 0000 0000
18:07:23.023048 63.98.234.3.62287 > good.guys.net.180.80: . ack 2802900339 win 3072
                         4500 0028 d73f 0000 2306 5eb0 3f62 ea03
                         **** 66b4 f34f 0050 4f60 1c23 a710 dd73
                         5010 0c00 5e4c 0000 0000 0000 0000
18:07:23.130555 63.98.234.3 > good.guys.net.190: icmp: echo request
                         4500 001c f3c4 0000 1e01 4732 3f62 ea03
                         **** 66be 0800 063f 3bbd b603 0000 0000
                         0000 0000 0000 0000 0000 0000 0000
18:07:23.135143 63.98.234.3.62287 > good.guys.net.190.80: . ack 938495728 win 3072
                         4500 0028 b0b7 0000 2306 852e 3f62 ea03
                         **** 66be f34f 0050 9c88 1db3 37f0 4ef0
                         5010 0c00 0d2e 0000 0000 0000 0000
--
George Bakos, Security Engineer
Electronic Warfare Associates-Information & Infrastructure Technologies
alpinista () bigfoot com
802-338-3213