Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.security > #118 > unrolled thread

What is it?

Started by"õÂÉÔØ ÓÐÁÍÅÒÁ" <dev@null.id>
First post2012-04-18 06:05 +0000
Last post2012-04-20 16:52 +0100
Articles 4 — 2 participants

Back to article view | Back to comp.os.linux.security

Contents

  What is it? "õÂÉÔØ ÓÐÁÍÅÒÁ" <dev@null.id> - 2012-04-18 06:05 +0000
    Re: What is it? Chris Davies <chris-usenet@roaima.co.uk> - 2012-04-19 08:58 +0100
      Re: What is it? "õÂÉÔØ ÓÐÁÍÅÒÁ" <dev@null.id> - 2012-04-20 09:39 +0000
        Re: What is it? Chris Davies <chris-usenet@roaima.co.uk> - 2012-04-20 16:52 +0100

#118 — What is it?

From"õÂÉÔØ ÓÐÁÍÅÒÁ" <dev@null.id>
Date2012-04-18 06:05 +0000
SubjectWhat is it?
Message-ID<jmllk2$355$1@speranza.aioe.org>
Why they scan strange DPTs?

SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.96 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=52515 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.81 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=48176 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.134 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=55333 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.96 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=52515 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.81 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=48176 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.134 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=55333 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.96 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=52515 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.14.96 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=52515 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
SRC=65.49.68.176 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=42882 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.176 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=42882 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.176 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=42882 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.176 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=42882 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.170 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=37631 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.159 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=55127 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.170 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=37631 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.159 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=55127 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.156 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=58409 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.178 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=32999 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.176 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=42882 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.156 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=58409 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.178 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=32999 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.170 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=37631 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.159 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=55127 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.156 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=58409 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.178 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=32999 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.170 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=37631 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.159 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=55127 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.156 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=58409 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.178 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=32999 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.167 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=46204 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.167 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=46204 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.170 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=37631 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.159 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=55127 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.178 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=32999 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.156 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=58409 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.167 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=46204 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.167 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=46204 WINDOW=0 RES=0x00 ACK RST URGP=0 
SRC=65.49.68.167 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=0 DF PROTO=TCP SPT=80 DPT=46204 WINDOW=0 RES=0x00 ACK RST URGP=0 

-- 
Origin: У каждого философа две философии: одна обращена вовне, другая - для 
себя. - Д. Толанд

[toc] | [next] | [standalone]

#122

FromChris Davies <chris-usenet@roaima.co.uk>
Date2012-04-19 08:58 +0100
Message-ID<u5t469xda9.ln2@news.roaima.co.uk>
In reply to#118
"õÂÉÔØ ÓÐÁÍÅÒÁ" <dev@null.id> wrote:
> Why they scan strange DPTs?
> SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 

These look like web requests from DST to SRC. Either your iptables
logging has SRC and DST the wrong way round or else something's trying
to creep through a naive packet filter. I'd be inclined to go with the
former suggestion.

Chris

[toc] | [prev] | [next] | [standalone]

#123

From"õÂÉÔØ ÓÐÁÍÅÒÁ" <dev@null.id>
Date2012-04-20 09:39 +0000
Message-ID<jmrat8$6c0$1@speranza.aioe.org>
In reply to#122
Чт., 19 апр. 2012 10:58:22 числа Chris Davies написал:
> "????? ???????" <dev@null.id> wrote:
>> Why they scan strange DPTs?
>> SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
> 
> These look like web requests from DST to SRC. Either your iptables
> logging has SRC and DST the wrong way round or else something's trying
> to creep through a naive packet filter. I'd be inclined to go with the
> former suggestion.

Too many hosts from one network listen 80 port. It is not strange? Local
processes should not ask remote side to establish connection. So, why remote
side may trying to do that very often? Also they trying connect on ports in
30??? range - it is not dynamical range and nobody listen 30??? here.

-- 
Origin: Политика - театр, молчит в нем хор, Кулисы труппа меряет шагами, Пока 
не даст отмашку дирижёр, Едва заметный в оркестровой яме. - Э. Севрус

[toc] | [prev] | [next] | [standalone]

#124

FromChris Davies <chris-usenet@roaima.co.uk>
Date2012-04-20 16:52 +0100
Message-ID<aad869xv0h.ln2@news.roaima.co.uk>
In reply to#123
"õÂÉÔØ ÓÐÁÍÅÒÁ" <dev@null.id> wrote:
> Чт., 19 апр. 2012 10:58:22 числа Chris Davies написал:
>> "????? ???????" <dev@null.id> wrote:
>>> Why they scan strange DPTs?
>>> SRC=65.49.14.73 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP SPT=80 DPT=51294 WINDOW=5792 RES=0x00 ACK SYN URGP=0 
>> 
>> These look like web requests from DST to SRC. Either your iptables
>> logging has SRC and DST the wrong way round or else something's trying
>> to creep through a naive packet filter. I'd be inclined to go with the
>> former suggestion.

> Too many hosts from one network listen 80 port. It is not strange?

No. Read what I said again. These are almost certainly mis-logged
requests from YOUR system to web servers running on the remote systems
such as 65.49.14.73.

Chris

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.security

csiph-web