Re: Ip spoof from 0.0.0.0

A few more data points:

This scan has targeted every /24 in a /20 here. While the third and fourth octets appear random, there are a couple interesting things:

1. 1460 unique IPs have been targeted out of 2321 total deny entries. There is some duplication of effort.
2. Thus far none of the dst IPs have been above the /25 boundary in each /24. If the fourth octet scan is actually limited to 0-127, then ~70% of the possible targets here have been chosen at least once.

A time distribution sample across the 4th octet looks like this:

Nov  1 07:56:54 MST x.y.92.0
Nov  1 12:44:08 MST x.y.83.0
Nov  1 15:59:31 MST x.y.84.0
Nov  1 17:10:40 MST x.y.80.0
Nov  1 23:02:18 MST x.y.91.0
Nov  1 23:03:11 MST x.y.81.0
Nov  2 16:24:15 MST x.y.91.0
Nov  2 18:10:17 MST x.y.95.0
Nov  2 22:24:18 MST x.y.86.0
Nov  3 12:09:46 MST x.y.85.0
Nov  4 07:26:20 MST x.y.84.0
Nov  4 19:10:54 MST x.y.94.0
Nov  4 20:38:13 MST x.y.85.0
Nov  4 21:15:37 MST x.y.84.0

Across the 3rd octet it looks like this:

Nov  4 00:27:30 MST x.y.84.119
Nov  4 00:41:48 MST x.y.84.61
Nov  4 00:57:01 MST x.y.84.18
Nov  4 02:03:55 MST x.y.84.88
Nov  4 02:26:48 MST x.y.84.41
Nov  4 02:46:15 MST x.y.84.98
Nov  4 05:06:20 MST x.y.84.2
Nov  4 05:24:50 MST x.y.84.51
Nov  4 06:09:48 MST x.y.84.7
Nov  4 06:30:17 MST x.y.84.50
Nov  4 07:20:39 MST x.y.84.110
Nov  4 07:25:42 MST x.y.84.69
Nov  4 07:26:20 MST x.y.84.0
Nov  4 08:13:32 MST x.y.84.55
Nov  4 08:25:58 MST x.y.84.46
Nov  4 10:54:05 MST x.y.84.4
Nov  4 11:32:05 MST x.y.84.87
Nov  4 12:28:25 MST x.y.84.117
Nov  4 12:38:27 MST x.y.84.91

Also, our logs show only a single packet denied in every instance.

Perhaps the payload is intended to DoS the victim per this:

http://online.securityfocus.com/archive/1/256830

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Mike