Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip)

On Fri, 31 Jan 2003 at 3:01:49 +0100, Peter Triller wrote:
> >I am seeing a lot of sync/ack packets from port 80 to non-existent

I may be wrong - if so, please don't hesitate to correct me and explain what happens in such situation:

Let's say that a router is configured (with ACLs) to deny packets from 255.255.255.255 (that's why I noticed them). Then it sends back an "ICMP unreachable", doesn't it?
These ICMP packets try to travel to... 255.255.255.255! Would'n it cause a multiplying?
I know that a router/firewall may be configured to _not_ send "ICMP unreachables" but default is to send them.

BTW, I seem to remember that _not_ sending "ICMP unreachables" is somehow against RFC... Of course security reasons for not sending them may be important (e.g. for hiding some network devices) but _formally_... it's a little not good :-) .

> sport 80 is obviously to bypass some firewalls.

Probably.

> But if he doesnt get feedback only 2 reasons pop into mind:

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

If my sentences above make some sense, could it be a DDoS founded on flood of ICMP unreachables?

> - a very badly configured and/or broken piece of software/hadware.

-- 
 Tomasz Papszun   SysAdm @ TP S.A. Lodz, Poland  | And it's only
 
tomek(at)lodz.tpsa.pl   
http://www.lodz.tpsa.pl/   | ones and zeros.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com