(no subject)
"Jack McCarthy" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
Looks like Chris may be right with respect to spoofing. I contacted the Russian ISP, Corbina Telecom, and they believe the packets are spoofed. I attached their reply below. ------------------------------------- Good afternoon, Jack. In reply to your letter of Thursday, 10:36 PM, 11/11/2004: it seems to us that these're a fake packets because our client, that uses this network, has very small outgoing traffic now and they use only few ip-addresses, the most part of this network is unused ------------------------------------- -Jack --- Chris Brenton <[email protected]> wrote: > Hey Carles, > > On Mon, 2004-11-08 at 19:00, Carles Fragoso i Mariscal wrote: > > > > We are receiving a strange set of ip fragments against one of our dns > servers (A.B.C.D) > > Not that strange, it looks like a standard attempt to exhaust resources. > To cut and paste for a moment: > > > 00:22:15.078691 83.102.166.7 > A.B.C.D: (frag 1861:25@512) > > 00:22:20.986039 83.102.166.33 > A.B.C.D: (frag 38756:25@512) > > 00:22:29.909213 83.102.166.44 > A.B.C.D: (frag 1718:25@512) > > 00:22:33.038511 83.102.166.43 > A.B.C.D: (frag 57823:25@512) > > So different frag ID's will cause different pools of memory to get > allocated. They are trying to generate as many memory allocations as > possible, in order to deny access from legitimate frags. > > The 512 byte offset plus the 25 bytes of data is a bit weird as this > exceeds the acceptable datagram size for DNS over UDP. Since the frags > are never fully re-assembled however, it does not really matter. > > > which seems sourced from the same C class (83.102.166.0/24, a Russian ISP) > > Be careful with that assumption. We're talking UDP so its trivial to > spoof. Its far more likely someone is incrementing the source IP rather > than all these IP's are involved in a coordinated attack. With this in > mind, the true source could be anywhere. > > > That network seems to be between 11 and 14 hops away giving a possible > initial TTL of 60-64. > > My money is on 64 at 14 hops away. > > HTH, > Chris > > > _______________________________________________ > Intrusions mailing list > [email protected] > http://www.dshield.org/mailman/listinfo/intrusions > > > _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions