RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip)

Today we have been receiving on average 380,000 requests an hour TO 255.255.255.255 FROM random IPs. I performed a reverse DNS query on a sample of 200 hosts, 2 of which came back with hostnames. A ping scan of the very same 200 hosts showed that only around 20 were *active*.

I contacted our ISP and was told that this traffic was "normal".

Has anyone else seen any similar requests?

Regards

Greg Bolshaw

Original Message:

On Thu, 30 Jan 2003 at 14:31:36 +1100, Keith Owens wrote:
> On Wed, 29 Jan 2003 21:46:53 +1100,
S866282571:866282571(0) ack 268566529 win 16384 <mss 1460>
>
> I am seeing a lot of sync/ack packets from port 80 to non-existent

Similarly at my networks.
Yesterday evening (Jan 29 21:10 GMT+1) a very noticeable stream of such packets started to come into my networks.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

All are TCP, from 255.255.255.255(80), destined to various random addresses (even not used) to various port numbers.

This appearance is very noticeable. Before yesterday, single packets from 255.255.255.255 were coming in rate about one for three weeks. Since yesterday there have been about 1680 for 22 hours.

-- 
 Tomasz Papszun   SysAdm @ TP S.A. Lodz, Poland  | And it's only
 
tomek(at)lodz.tpsa.pl   
http://www.lodz.tpsa.pl/   | ones and zeros.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com


--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com