Re: strange set of ip fragments against dns server

Hey Carles,

On Mon, 2004-11-08 at 19:00, Carles Fragoso i Mariscal wrote:
>
> We are receiving a strange set of ip fragments against one of our dns servers (A.B.C.D)

Not that strange, it looks like a standard attempt to exhaust resources.
To cut and paste for a moment:

> 00:22:15.078691 83.102.166.7     > A.B.C.D: (frag 1861:25@512)
> 00:22:20.986039 83.102.166.33    > A.B.C.D: (frag 38756:25@512)
> 00:22:29.909213 83.102.166.44    > A.B.C.D: (frag 1718:25@512)
> 00:22:33.038511 83.102.166.43    > A.B.C.D: (frag 57823:25@512)

So different frag ID's will cause different pools of memory to get
allocated. They are trying to generate as many memory allocations as
possible, in order to deny access from legitimate frags.

The 512 byte offset plus the 25 bytes of data is a bit weird as this
exceeds the acceptable datagram size for DNS over UDP. Since the frags
are never fully re-assembled however, it does not really matter. 

> which seems sourced from the same C class (83.102.166.0/24, a Russian ISP)

Be careful with that assumption. We're talking UDP so its trivial to
spoof. Its far more likely someone is incrementing the source IP rather
than all these IP's are involved in a coordinated attack. With this in
mind, the true source could be anywhere.

> That network seems to be between 11 and 14 hops away giving a possible initial TTL of 60-64.

My money is on 64 at 14 hops away.

HTH,
Chris


_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions