From: /dev/rob0 <rob0@gmx.co.uk>
To: netfilter@vger.kernel.org
Subject: -p udp and --ctstate NEW
Date: Tue, 16 Nov 2010 18:15:17 -0600 [thread overview]
Message-ID: <20101117001517.GV23013@cardinal> (raw)
I'm experimenting with -m recent to stem SIP attacks. As part of the
experiment I have a --ctstate NEW -p udp --dport 5060 -j LOG rule to
log new SIP "connections".
I'm currently under attack from 61.135.88.173 in China, and the
strange thing was that all those LOG lines were identical except for
slight fluxuations in length. All same source port, 5164. (The length
fluxuations make sense, I saw part of the attack as it began, and it
was running through a dictionary of names.)
What I'm curious about is how those were all --ctstate NEW, why not
ESTABLISHED? I thought the same source.IP:sport -> dest.IP:dport
would be seen as ESTABLISHED.
Asterisk console snippet of the attack before blocking:
[Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"hannibal"<sip:hannibal@192.0.2.160>' failed for '61.135.88.173' - No matching peer found
[Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"hannible"<sip:hannible@192.0.2.160>' failed for '61.135.88.173' - No matching peer found
[Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"harding"<sip:harding@192.0.2.160>' failed for '61.135.88.173' - No matching peer found
[Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"harrison"<sip:harrison@192.0.2.160>' failed for '61.135.88.173' - No matching peer found
[Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"harvard"<sip:harvard@192.0.2.160>' failed for '61.135.88.173' - No matching peer found
[Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"hathaway"<sip:hathaway@192.0.2.160>' failed for '61.135.88.173' - No matching peer found
LOG rules:
[1:362] -A BadGuy -p udp -j LOG --log-prefix "SIP attacker: "
...
[19:6866] -A WAN -p udp -m conntrack --ctstate NEW -m udp --dport 5060 -j LOG --log-prefix "NEW SIP: "
$ dmesg | tail -20
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=360 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=340
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=359 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=339
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
SIP attacker: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
--
Offlist mail to this address is discarded unless
"/dev/rob0" or "not-spam" is in Subject: header
reply other threads:[~2010-11-17 0:15 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20101117001517.GV23013@cardinal \
--to=rob0@gmx.co.uk \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).