Security Incidents mailing list archives
RE: strange traffic
From: "Rob Shein" <shoten () starpower net>
Date: Tue, 24 Dec 2002 15:07:16 -0500
Well, you're also assuming that the packets came from the IP addresses that they SAY they came from. It's possible that this was covert channel communications from one machine. Did you by any chance grab the actual contents of the pings? Also, why do you assume that other computers on your ISP's network may have been affected, and it if wasn't directed at your gateway, what kind of system WAS it directed at?
-----Original Message----- From: securitynotice () cronus cnicinc com [mailto:securitynotice () cronus cnicinc com] Sent: Sunday, December 22, 2002 11:31 PM To: incidents () securityfocus com Subject: strange traffic Tonight at 6:04pm est, a bunch of ping packets hit my gateway from a variety of sources in two . I am assuming the following: + this was not directed at my gateway specifically, but I am assuming + that other computers on my ISP's network may have also been affected + this is not a DoS attempt, too few packets + because it was from sources on a bunch of different networks, the ip addresses here I'm assuming are compromised IP addresses My question(s) for the group here is, what was the purpose behind this traffic? It doesn't appear to be just reconnaisance gathering (this would be overkill). Your insights would be appreciated... Thanks! Michael Webb note: the logs have been modified changing the hostname to 'myhost' and the target ip to 'www.xxx.yyy.zzz'. Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2752 F=0x0000 T=55 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6054 F=0x0000 T=56 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27604 F=0x0000 T=54 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64177 F=0x0000 T=53 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=34747 F=0x0000 T=47 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=15194 F=0x0000 T=57 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62383 F=0x0000 T=47 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27709 F=0x0000 T=56 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19912 F=0x0000 T=51 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19198 F=0x0000 T=55 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=36239 F=0x0000 T=50 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62363 F=0x0000 T=46 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=53914 F=0x0000 T=50 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65109 F=0x0000 T=57 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3076 F=0x0000 T=55 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6396 F=0x0000 T=56 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28911 F=0x0000 T=54 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65317 F=0x0000 T=53 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=16636 F=0x0000 T=57 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35371 F=0x0000 T=47 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28658 F=0x0000 T=56 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63011 F=0x0000 T=47 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19541 F=0x0000 T=55 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=37238 F=0x0000 T=50 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63227 F=0x0000 T=46 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=25147 F=0x0000 T=51 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=54801 F=0x0000 T=50 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=961 F=0x0000 T=57 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3359 F=0x0000 T=55 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6739 F=0x0000 T=56 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=30150 F=0x0000 T=54 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=789 F=0x0000 T=53 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35953 F=0x0000 T=47 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63666 F=0x0000 T=47 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=18156 F=0x0000 T=57 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=29583 F=0x0000 T=56 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19919 F=0x0000 T=55 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64162 F=0x0000 T=46 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=38267 F=0x0000 T=50 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=26924 F=0x0000 T=51 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=55687 F=0x0000 T=50 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2304 F=0x0000 T=57 (#1) -------------------------------------------------------------- -------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- strange traffic securitynotice (Dec 23)
- RE: strange traffic Rob Shein (Dec 27)