RE: UDP packets from Apache ? New DDOS ?

["Bojan Zdrnja" <Bojan.Zdrnja () LSS hr>]

Dave, 

> -----Original Message-----
> From: Dave Foster [mailto:dave () canadian net] 
> Sent: Thursday, 8 July 2004 5:51 a.m.
> To: incidents () securityfocus com
> Subject: UDP packets from Apache ? New DDOS ?
>
> Hi All,
>
> blocking UDP from that host. He has provided a TCPdump to me, 
> a portion of
> which follows. Can anyone shed some light, on what might be 
> the cause, has
> it been seen before?
>
> 07:40:52.116687 IP 192.168.1.106.49043 > 209.123.78.248.50567: UDP, =
> length: 1000
> 0x0000: 4500 0404 0000 4000 4011 5463 c0a8 016a =
> E.....@.@.Tc...j 0x0010: d17b 4ef8 bf93 c587 03f0 2703 4242 4242 =
> .{N.......'.BBBB
> 0x0020: 4242 4242 4242 4242 4242 4242 4242 4242 =
> BBBBBBBBBBBBBBBB
> 0x0030: 4242 4242 4242 BBBBBB

This is a part of NetBIOS Name Service packet - however it is not complete
(or it's malformed).
You can decode it if you check headers, 0x4500 should be message ID, 0x0404
after that are flags showing it's a name query etc.

The real question here is: what are those packets doing on those ports. It
should have used 137/UDP only, so this could be some attempt of a flood. If
it indeed is a plain DoS, the question remains of how did NetBIOS NS packet
data come into this.

If you can get more packet logs it would be useful.

Cheers,

Bojan Zdrnja
CISSP