* RE: Snuffing out hackers
@ 2003-07-16 20:21 Daniel Chemko
2003-07-16 21:14 ` Sebastian
0 siblings, 1 reply; 6+ messages in thread
From: Daniel Chemko @ 2003-07-16 20:21 UTC (permalink / raw)
To: Aldo S. Lagana, netfilter
[-- Attachment #1: Type: text/plain, Size: 1940 bytes --]
I am on Shaw, but none of these addresses are used for anything to do
with my network.
I am doing some pretty anal filtering, but then again, I may be missing
something pretty obvious. I have rp_filter at 2 and source routing
disabled.
PS: I am getting MANY of these packets. These packets are not getting
through to their targets, but if someone is persistent enough to keep
trying, I assume they must be able to do something malicious.
-----Original Message-----
From: Aldo S. Lagana [mailto:alagana@discmail.com]
Sent: Wednesday, July 16, 2003 12:32 PM
To: Daniel Chemko; netfilter@lists.netfilter.org
Subject: RE: Snuffing out hackers
Both IP addresses are assigned to cable ISPs...
Name: h24-87-243-251.vc.shawcable.net
Address: 24.87.243.251
Name: d57-108-11.home.cgocable.net
Address: 24.57.108.11
Not sure if either of them are your ISP? But I would contact both ISPs
with your log data if you really cared. Are you running squid? A
webserver?
_____
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Daniel Chemko
Sent: Wednesday, July 16, 2003 2:58 PM
To: netfilter@lists.netfilter.org
I am getting some disturbing packet traffic hitting my firewall. Here
goes:
IN=eth4 OUT=eth5 SRC=24.87.243.251 DST=24.57.108.11 LEN=76 TOS=0x00
PREC=0xC0 TTL=25
4 ID=17431 PROTO=ICMP TYPE=3 CODE=3 [SRC=24.57.108.11 DST=24.87.243.251
LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=15860 DF PROTO=TCP SPT=
3161 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0 ]
None of the addresses listed in the packets are from my networks, but
what is more disturbing is that eth4 is my internal network interface.
Can anyone see (baring an internal intrusion has occurred) how this can
happen?
It definitely appears to be an exploit on my configuration or something.
[-- Attachment #2: Type: text/html, Size: 8464 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Snuffing out hackers
2003-07-16 20:21 Snuffing out hackers Daniel Chemko
@ 2003-07-16 21:14 ` Sebastian
0 siblings, 0 replies; 6+ messages in thread
From: Sebastian @ 2003-07-16 21:14 UTC (permalink / raw)
To: 'Daniel Chemko', Netfilter Mailinglist
Hi there...
Just a thought:
If you are getting many of those packtes, than it should be possible to
catch one of it with tcpdump to find out senders MAC address. This will
pearhaps allow to find you the source, if it's realy located on your
internal network.
Greets
Sebastian.
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Daniel Chemko
Sent: Wednesday, July 16, 2003 10:22 PM
To: Aldo S. Lagana; netfilter@lists.netfilter.org
Subject: RE: Snuffing out hackers
I am on Shaw, but none of these addresses are used for anything to do
with my network.
I am doing some pretty anal filtering, but then again, I may be missing
something pretty obvious. I have rp_filter at 2 and source routing
disabled.
PS: I am getting MANY of these packets. These packets are not getting
through to their targets, but if someone is persistent enough to keep
trying, I assume they must be able to do something malicious.
-----Original Message-----
From: Aldo S. Lagana [mailto:alagana@discmail.com]
Sent: Wednesday, July 16, 2003 12:32 PM
To: Daniel Chemko; netfilter@lists.netfilter.org
Subject: RE: Snuffing out hackers
Both IP addresses are assigned to cable ISPs.
Name: h24-87-243-251.vc.shawcable.net
Address: 24.87.243.251
Name: d57-108-11.home.cgocable.net
Address: 24.57.108.11
Not sure if either of them are your ISP? But I would contact both ISPs
with your log data if you really cared. Are you running squid? A
webserver?
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Daniel Chemko
Sent: Wednesday, July 16, 2003 2:58 PM
To: netfilter@lists.netfilter.org
I am getting some disturbing packet traffic hitting my firewall. Here
goes:
IN=eth4 OUT=eth5 SRC=24.87.243.251 DST=24.57.108.11 LEN=76 TOS=0x00
PREC=0xC0 TTL=25
4 ID=17431 PROTO=ICMP TYPE=3 CODE=3 [SRC=24.57.108.11 DST=24.87.243.251
LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=15860 DF PROTO=TCP SPT=
3161 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0 ]
None of the addresses listed in the packets are from my networks, but
what is more disturbing is that eth4 is my internal network interface.
Can anyone see (baring an internal intrusion has occurred) how this can
happen?
It definitely appears to be an exploit on my configuration or something.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Snuffing out hackers
@ 2003-07-16 18:58 Daniel Chemko
2003-07-16 19:32 ` Aldo S. Lagana
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Daniel Chemko @ 2003-07-16 18:58 UTC (permalink / raw)
To: netfilter
[-- Attachment #1: Type: text/plain, Size: 684 bytes --]
I am getting some disturbing packet traffic hitting my firewall. Here
goes:
IN=eth4 OUT=eth5 SRC=24.87.243.251 DST=24.57.108.11 LEN=76 TOS=0x00
PREC=0xC0 TTL=25
4 ID=17431 PROTO=ICMP TYPE=3 CODE=3 [SRC=24.57.108.11 DST=24.87.243.251
LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=15860 DF PROTO=TCP SPT=
3161 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0 ]
None of the addresses listed in the packets are from my networks, but
what is more disturbing is that eth4 is my internal network interface.
Can anyone see (baring an internal intrusion has occurred) how this can
happen?
It definitely appears to be an exploit on my configuration or something.
[-- Attachment #2: Type: text/html, Size: 2896 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread* RE: Snuffing out hackers
2003-07-16 18:58 Daniel Chemko
@ 2003-07-16 19:32 ` Aldo S. Lagana
2003-07-16 19:47 ` Ramin Dousti
2003-08-01 6:50 ` Pascal Italiaander
2 siblings, 0 replies; 6+ messages in thread
From: Aldo S. Lagana @ 2003-07-16 19:32 UTC (permalink / raw)
To: 'Daniel Chemko', netfilter
[-- Attachment #1: Type: text/plain, Size: 1254 bytes --]
Both IP addresses are assigned to cable ISPs.
Name: h24-87-243-251.vc.shawcable.net
Address: 24.87.243.251
Name: d57-108-11.home.cgocable.net
Address: 24.57.108.11
Not sure if either of them are your ISP? But I would contact both ISPs with
your log data if you really cared. Are you running squid? A webserver?
_____
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Daniel Chemko
Sent: Wednesday, July 16, 2003 2:58 PM
To: netfilter@lists.netfilter.org
I am getting some disturbing packet traffic hitting my firewall. Here goes:
IN=eth4 OUT=eth5 SRC=24.87.243.251 DST=24.57.108.11 LEN=76 TOS=0x00
PREC=0xC0 TTL=25
4 ID=17431 PROTO=ICMP TYPE=3 CODE=3 [SRC=24.57.108.11 DST=24.87.243.251
LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=15860 DF PROTO=TCP SPT=
3161 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0 ]
None of the addresses listed in the packets are from my networks, but what
is more disturbing is that eth4 is my internal network interface. Can anyone
see (baring an internal intrusion has occurred) how this can happen?
It definitely appears to be an exploit on my configuration or something.
[-- Attachment #2: Type: text/html, Size: 5727 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Snuffing out hackers
2003-07-16 18:58 Daniel Chemko
2003-07-16 19:32 ` Aldo S. Lagana
@ 2003-07-16 19:47 ` Ramin Dousti
2003-08-01 6:50 ` Pascal Italiaander
2 siblings, 0 replies; 6+ messages in thread
From: Ramin Dousti @ 2003-07-16 19:47 UTC (permalink / raw)
To: Daniel Chemko; +Cc: netfilter
This is an icmp(3:3) which means port unreachable. This is an innocent
icmp. However, the question is as to why you receive it on your router
if 24.57.108.11 has nothing to do with you... If it's a correct statement
that it's coming from outside and you don't have anything to do with
24.57.108.11, then the only way it could come to you is by source-routing
which should have been turned off by your ISP in the first place...
Ramin
On Wed, Jul 16, 2003 at 11:58:28AM -0700, Daniel Chemko wrote:
> I am getting some disturbing packet traffic hitting my firewall. Here
> goes:
>
>
>
> IN=eth4 OUT=eth5 SRC=24.87.243.251 DST=24.57.108.11 LEN=76 TOS=0x00
> PREC=0xC0 TTL=25
>
> 4 ID=17431 PROTO=ICMP TYPE=3 CODE=3 [SRC=24.57.108.11 DST=24.87.243.251
> LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=15860 DF PROTO=TCP SPT=
>
> 3161 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0 ]
>
>
>
> None of the addresses listed in the packets are from my networks, but
> what is more disturbing is that eth4 is my internal network interface.
> Can anyone see (baring an internal intrusion has occurred) how this can
> happen?
>
>
>
> It definitely appears to be an exploit on my configuration or something.
>
>
>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Snuffing out hackers
2003-07-16 18:58 Daniel Chemko
2003-07-16 19:32 ` Aldo S. Lagana
2003-07-16 19:47 ` Ramin Dousti
@ 2003-08-01 6:50 ` Pascal Italiaander
2 siblings, 0 replies; 6+ messages in thread
From: Pascal Italiaander @ 2003-08-01 6:50 UTC (permalink / raw)
To: netfilter
Op woensdag 16 juli 2003 20:58, schreef Daniel Chemko:
> I am getting some disturbing packet traffic hitting my firewall. Here
> goes:
>
>
>
> IN=eth4 OUT=eth5 SRC=24.87.243.251 DST=24.57.108.11 LEN=76 TOS=0x00
> PREC=0xC0 TTL=25
>
> 4 ID=17431 PROTO=ICMP TYPE=3 CODE=3 [SRC=24.57.108.11 DST=24.87.243.251
> LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=15860 DF PROTO=TCP SPT=
>
> 3161 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0 ]
>
>
>
> None of the addresses listed in the packets are from my networks, but
> what is more disturbing is that eth4 is my internal network interface.
> Can anyone see (baring an internal intrusion has occurred) how this can
> happen?
>
>
>
> It definitely appears to be an exploit on my configuration or something.
To snif out hackers , to watch their activities, or block them ,you could put
a bridge in front of your firewall ( OpenBSD perhaps ).
Since the bridge has no IP-address no hacker noticed that you're watching, or
has no clue what blocks him. Even better , the bridge can not be attacked or
hacked. ( since there is no ip-address the bridge is NOT seen as a part of
youre network , no extra HOP is seen, makes it almost invissible )
Some advanced method could be a honeypot.
This can give you more output about attacks or whatever an intruder wants to.
Pascal
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-08-01 6:50 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-07-16 20:21 Snuffing out hackers Daniel Chemko
2003-07-16 21:14 ` Sebastian
-- strict thread matches above, loose matches on Subject: below --
2003-07-16 18:58 Daniel Chemko
2003-07-16 19:32 ` Aldo S. Lagana
2003-07-16 19:47 ` Ramin Dousti
2003-08-01 6:50 ` Pascal Italiaander
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox