strange traffic

From: <securitynotice(at)cronus.cnicinc.com>
Date: Sun Dec 22 2002 - 23:30:31 EST

Tonight at 6:04pm est, a bunch of ping packets hit my gateway from a variety of sources in two . I am assuming the following:

+ this was not directed at my gateway specifically, but I am assuming that
other computers on my ISP's network may have also been affected
+ this is not a DoS attempt, too few packets
+ because it was from sources on a bunch of different networks, the ip
addresses here I'm assuming are compromised IP addresses

My question(s) for the group here is, what was the purpose behind this traffic? It doesn't appear to be just reconnaisance gathering (this would be overkill). Your insights would be appreciated...

Thanks!

Michael Webb

note: the logs have been modified changing the hostname to 'myhost' and the target ip to 'www.xxx.yyy.zzz'.
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2752 F=0x0000 T=55 (#1)

Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6054 F=0x0000 T=56 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27604 F=0x0000 T=54 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64177 F=0x0000 T=53 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=34747 F=0x0000 T=47 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=15194 F=0x0000 T=57 (#1)

Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62383 F=0x0000 T=47 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27709 F=0x0000 T=56 (#1)

Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19912 F=0x0000 T=51 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19198 F=0x0000 T=55 (#1)

Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=36239 F=0x0000 T=50 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62363 F=0x0000 T=46 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=53914 F=0x0000 T=50 (#1)

Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65109 F=0x0000 T=57 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3076 F=0x0000 T=55 (#1)

Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6396 F=0x0000 T=56 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28911 F=0x0000 T=54 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related securityfocus.com Links
bugtraq
certification
focus-bsd
focus-ids
focus-ih
focus-linux
focus-ms
focus-sun
focus-unix-other
focus-virus
forensics
incidents
libnet
linux-secnews
ms-secnews
pen-test
secpapers
secprog
sectools
secureshell
security-basics
securityjobs
sf-news
vuln-dev
webappsec
Request more information about Pantek
64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65317 F=0x0000 T=53 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=16636 F=0x0000 T=57 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35371 F=0x0000 T=47 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28658 F=0x0000 T=56 (#1)

Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63011 F=0x0000 T=47 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19541 F=0x0000 T=55 (#1)

Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=37238 F=0x0000 T=50 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63227 F=0x0000 T=46 (#1)

Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=25147 F=0x0000 T=51 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=54801 F=0x0000 T=50 (#1)

Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=961 F=0x0000 T=57 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3359 F=0x0000 T=55 (#1)

Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6739 F=0x0000 T=56 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=30150 F=0x0000 T=54 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=789 F=0x0000 T=53 (#1)

Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35953 F=0x0000 T=47 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63666 F=0x0000 T=47 (#1)

Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=18156 F=0x0000 T=57 (#1)
Do you need more help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related securityfocus.com Links
bugtraq
certification
focus-bsd
focus-ids
focus-ih
focus-linux
focus-ms
focus-sun
focus-unix-other
focus-virus
forensics
incidents
libnet
linux-secnews
ms-secnews
pen-test
secpapers
secprog
sectools
secureshell
security-basics
securityjobs
sf-news
vuln-dev
webappsec
Request more information about Pantek
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=29583 F=0x0000 T=56 (#1)

Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19919 F=0x0000 T=55 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64162 F=0x0000 T=46 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=38267 F=0x0000 T=50 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 

212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=26924 F=0x0000 T=51 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=55687 F=0x0000 T=50 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2304 F=0x0000 T=57 (#1)

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Dec 23 13:20:26 2002