Re: Strange attack question - seems udp

On 18.10.2005 13:21 Uhr "Mihai Tanasescu" wrote as <[email protected]>:

> Hello,
> 
> Thanks for explainning the reason for udp ports not appearing in the
> tcpdump output.
> Well the Cisco 3750 is the gateway for my clients and not the
> destination host (so I can't figure why it starts choking)
> 
> The source IP addresses belong to my clients (those with 86.104 ).
> 
> And it usually happens like this:
> 3/4 ip addresses that belong to my clients contact the same 4-5 ip
> addresses like the one below (70.84.247.164) and start doing 98% only
> upload udp traffic.
> 
> Is it possibly for a service to do so much upload compared to download ?

May be this is not the right question. You'd should rather question "what
the hell is talking to 70.84.247.164?"

And 98% upstream udp ist strange in the second step.

-- 
"Theoretisch ist es praktisch, aber praktisch ist es unpraktisch" Bernhard
P.