Unwanted Uploading.

Unwanted Uploading.

[ads nat]

[-- Attachment #1: Type: text/plain, Size: 757 bytes --]

Hi,
My network has slowed drastically, It was working o.k. with same bandwidth fro last 3 months but from last 2 weeks it has slowed down. When checked with my ISP says their is lot of uploading from my users side. When talked with users user says their is no extar ordinary increase in uploading or downloading. My ISP say there must be  some 
virus/worm in the network.
I donlt know anything about it but very mush interested to solve problem. 
Can you guide me to detetc whether their is any unwanted uploading from user. Is their any tool or technology to detect and stop this. Can iptables check this problem.
Help apprecieated.
Thanks
 


---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 914 bytes --]

Re: Unwanted Uploading.

[ads nat]

[-- Attachment #1: Type: text/plain, Size: 1291 bytes --]

My /etc/rc.d/rc.local file settinga re as follows.
********
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface tunnel0 -j MASQUERADE
iptables --append FORWARD --in-interface eth1 -j ACCEPT

iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128
*****


ads nat <adsnat@yahoo.com> wrote:
Hi,
My network has slowed drastically, It was working o.k. with same bandwidth fro last 3 months but from last 2 weeks it has slowed down. When checked with my ISP says their is lot of uploading from my users side. When talked with users user says their is no extar ordinary increase in uploading or downloading. My ISP say there must be  some 
virus/worm in the network.
I donlt know anything about it but very mush interested to solve problem. 
Can you guide me to detetc whether their is any unwanted uploading from user. Is their any tool or technology to detect and stop this. Can iptables check this problem.
Help apprecieated.
Thanks
 


---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 1718 bytes --]

Re: Unwanted Uploading.

[Chris Brenton]

ads nat wrote:
>
> When talked with users user says their is no extar ordinary 
> increase in uploading or downloading. My ISP say there must be  some
> virus/worm in the network.

Sounds like you are one of the sites flooding people with icmp :(

Try this:
tcpdump -v -nn icmp

Look at the source IP's of the echo-request packets and fix your systems.

If that does not help, try a tool like ntop or iptraf which will tell 
you who is generating all the traffic.

HTH,
C

Re: Unwanted Uploading.

[ads nat]

[-- Attachment #1: Type: text/plain, Size: 1747 bytes --]

Hi,
By giving command "tcpdump -v -nn icmp"
I get follwoing :
*****
09:31:38.307409 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:31:39.308771 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:31:40.310974 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:31:41.312619 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:31:42.314766 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:36:38.961942 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:36:39.964662 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:36:40.967854 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:36:41.969910 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
09:36:42.978050 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) (ttl 58,
 id 0, len 84)
******
 
My Server ethrenet external ID is 202.183.69.130
How to go ahead.
Thanks

Chris Brenton <cbrenton@chrisbrenton.org> wrote:
ads nat wrote:
>
> When talked with users user says their is no extar ordinary 
> increase in uploading or downloading. My ISP say there must be some
> virus/worm in the network.

Sounds like you are one of the sites flooding people with icmp :(

Try this:
tcpdump -v -nn icmp

Look at the source IP's of the echo-request packets and fix your systems.

If that does not help, try a tool like ntop or iptraf which will tell 
you who is generating all the traffic.

HTH,
C




---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 2264 bytes --]

Re: Unwanted Uploading.

[Chris Brenton]

ads nat wrote:
> Hi,
> By giving command "tcpdump -v -nn icmp"
> I get follwoing :
> *****
> 09:31:38.307409 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) 
> (ttl 58, id 0, len 84)

Is 202.63.164.12 part of your internal address space? I'm guessing its 
not because the TTL is not normal for a local Windows system.

Try this, run the command:
ifconfig

and identify which interface is the internal interface of your firewall 
(eth0, eth1, etc.). Then run one of the following commands:

tcpdump -i eth0 -v -nn icmp
or
tcpdump -i eth1 -v -nn icmp

depending on which interface faces your internal (inside) network.

Let the command run for a while and see if you capture anything. You 
should make sure that all of your systems are turned on so you don't 
miss anything. If you see a host sending out a ton of echo-request 
packets, investigate that host to find out why.

If you do not identify any internal systems causing the problem, then 
the problem is originating from outside your network. Going back to what 
you captured again for a moment:

> 09:31:39.308771 202.63.164.12 > 202.183.69.130: icmp: echo request (DF) 
> (ttl 58, id 0, len 84)

I'm sure you've heard about Blast and all the variants. One of those 
variants (Nachi) generates a flood of outbound echo-request packets from 
each infected machine. My guess is that your ISP (like myself when I 
first replied) feels this is a Nachi problem.

Now, the Nachi echo-request packets have a unique signature to them. To 
start, they always originate from a Windows system. Windows uses a 
default TTL of 128. This means that when you see a Nachi packet the TTL 
is usually between 112-128. The TTL in the packets you captured is 58. 
This could be a Nachi infected systems going through a proxy or IPFilter 
type system (or iptables using the --ttl-set option for that matter), 
but it looks kind of odd.

The don't fragment flag (DF) is turned on in the packets you captured. 
When Nachi generates traffic the don't fragment flag is usually turned 
off. Again, could be a firewall rewriting the info but I don't think so 
as its weird for the state of DF to get changed.

Nachi always generates echo-request packets that are 92 bytes in size. 
Your capture shows packets that are _84_ bytes in size. I guess it could 
be some variant (I run Linux only so I don't stay up on all the Windows 
worms), but again it looks kind of odd.

Also, a Nachi infected system does not continually beat up on a single 
IP address. You may see them hit the same IP over time, but its never a 
continual stream as shown in your trace. This also leads me to believe 
that this is not an infected Windows system.

So:..
The TTL is wrong to be Nachi
The DF setting is wrong to be Nachi
The packet size is wrong to be Nachi
The behavior is wrong to be Nachi

I'm guessing its not Nachi. ;-)

So the packets you are seeing out of India look more like some kind of 
echo-request flood. This could be a worm or it could be someone who is a 
jerk. Either way its not Nachi and you are losing bandwidth because of 
this flood of echo-request packets.

One thing you *might* be able to do is ask your ISP to filter out all 
echo-request (ICMP type 8, code 0) packets that are headed for your 
network. This would filter them out on your ISPs side, keeping them off 
your link and from sucking up your bandwidth. I have no idea if your ISP 
is willing to do this type of filtering for you or not.

If you need anything else please shout back directly as we've strayed a 
bit from the general subject of iptables.

HTH,
C