RE: strange set of ip fragments against dns server

"Perez, David (CS-Security&TS-Mad)" <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]>
Hi Carles,

Don't know what it is, but it seems that you're not the only one
receiving this kind of traffic:

http://lists.virus.org/dshield-0410/msg00222.html

http://www.afp548.com/eBBS/viewtopic.php?forum=18&showtopic=5419

Regards,
David.
---
[email protected]
10nov04 10:31 CET

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Carles Fragoso i
Mariscal
Sent: martes, 09 de noviembre de 2004 1:00
To: [email protected]
Subject: [Intrusions] strange set of ip fragments against dns server


Hi team,

We are receiving a strange set of ip fragments against one of our dns
servers (A.B.C.D) which seems sourced from the same C class
(83.102.166.0/24, a Russian ISP) where ttl is 49, len is 45 and IPIDs
seem to be pretty random. 

That network seems to be between 11 and 14 hops away giving a possible
initial TTL of 60-64.

Has someone seen anything similar? Any ideas?

...............................................................
00:22:15.078691 83.102.166.7     > A.B.C.D: (frag 1861:25@512)
00:22:20.986039 83.102.166.33    > A.B.C.D: (frag 38756:25@512)
00:22:29.909213 83.102.166.44    > A.B.C.D: (frag 1718:25@512)
00:22:33.038511 83.102.166.43    > A.B.C.D: (frag 57823:25@512)
00:22:48.414517 83.102.166.41    > A.B.C.D: (frag 64547:25@512)
00:23:08.288978 83.102.166.33    > A.B.C.D: (frag 22655:25@512)
00:23:13.400633 83.102.166.43    > A.B.C.D: (frag 47312:25@512)
00:23:14.412149 83.102.166.44    > A.B.C.D: (frag 162:25@512)
00:23:51.147341 83.102.166.54    > A.B.C.D: (frag 61959:25@512)
00:23:51.493758 83.102.166.58    > A.B.C.D: (frag 1958:25@512)
00:24:00.857637 83.102.166.76    > A.B.C.D: (frag 42278:25@512)
00:24:04.018650 83.102.166.59    > A.B.C.D: (frag 33613:25@512)
00:24:20.476301 83.102.166.24    > A.B.C.D: (frag 64081:25@512)
00:25:02.727780 83.102.166.46    > A.B.C.D: (frag 24596:25@512)
00:25:07.178172 83.102.166.49    > A.B.C.D: (frag 39212:25@512)
00:25:21.461390 83.102.166.131   > A.B.C.D: (frag 33871:25@512)
00:25:25.230504 83.102.166.217   > A.B.C.D: (frag 33265:25@512)
00:26:24.993722 83.102.166.26    > A.B.C.D: (frag 53763:25@512)
00:26:53.192919 83.102.166.23    > A.B.C.D: (frag 31197:25@512)
00:26:54.875637 83.102.166.45    > A.B.C.D: (frag 61715:25@512)
00:27:09.446301 83.102.166.59    > A.B.C.D: (frag 56906:25@512)
00:27:15.053166 83.102.166.22    > A.B.C.D: (frag 26055:25@512)
00:27:28.068247 83.102.166.47    > A.B.C.D: (frag 59043:25@512)
00:27:35.049413 83.102.166.54    > A.B.C.D: (frag 52384:25@512)
00:27:46.357032 83.102.166.53    > A.B.C.D: (frag 56693:25@512)
00:27:48.806295 83.102.166.52    > A.B.C.D: (frag 34849:25@512)
00:27:49.923808 83.102.166.33    > A.B.C.D: (frag 54862:25@512)
00:27:56.340161 83.102.166.21    > A.B.C.D: (frag 39111:25@512)
00:28:10.987790 83.102.166.15    > A.B.C.D: (frag 35496:25@512)
00:28:12.437082 83.102.166.55    > A.B.C.D: (frag 61556:25@512)
00:28:19.895857 83.102.166.46    > A.B.C.D: (frag 62827:25@512)
00:28:30.107670 83.102.166.22    > A.B.C.D: (frag 47444:25@512)
00:28:43.400149 83.102.166.49    > A.B.C.D: (frag 22142:25@512)
00:28:48.002011 83.102.166.46    > A.B.C.D: (frag 39714:25@512)
00:28:48.690701 83.102.166.33    > A.B.C.D: (frag 51581:25@512)
00:29:00.182057 83.102.166.15    > A.B.C.D: (frag 62629:25@512)
...............................................................

Thanks in advance!

------------------------------------------------------------------------
--
Carlos Fragoso Mariscal - Network & Security Engineer / Incident Handler
Anella Cientifica RREN Incident Response Team (ERIAC) - AS13041
CFM1-RIPE Communications and Operations Dept. - Supercomputing Center of
Catalonia mail:[email protected] phone:+34932056464 pgp:0x0E4EDE07
inocdba:13041*CFM
------------------------------------------------------------------------
--

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.