RE: Re: [fw-wiz] Wayyy too many spoofed packets

From: Bill Royds (broyds_at_rogers.com)
Date: 11/22/03

  • Next message: Mikael Olsson: "Re: [fw-wiz] Wayyy too many spoofed packets" 
    To: "'Chris de Vidal'" <chris@devidal.tv>
Date: Fri, 21 Nov 2003 19:31:22 -0500

    As Frank said, you machine is sending broadcasts on both interfaces for
    Samba. So you see the broadcasts as received as well. It is not coming from
    the net but from your machine itself.

    -----Original Message-----
    From: Chris de Vidal [mailto:chris@devidal.tv]
    Sent: November 21, 2003 3:37 PM
    To: Bill@royds.net
    Cc: firewall-wizards@honor.icsalabs.com
    Subject: Re: Re: [fw-wiz] Wayyy too many spoofed packets

    I'm going to be installing firewalls on my internal servers (yes, I'm
    paranoid). These include Samba servers.

    I shouldn't expect to see MY IP coming IN from the OUTSIDE.

    I saw this kind of spoof protection in another firewall script and copied
    it, so I'm sure the rule is correct and I've never seen traffic with MY IP
    originating on eth0.

    /dev/idal

    Bill Royds said:
    > Are you running Samba on the Linux box which is your firewall? It may be
    > that you are seeing traffic from the firewall box itself which has the IP
    > address on its eth0 interface does it not?
    > Samba will try to enumerate other SMB hosts on its subnet if it is
    > running. Backup will also try to find other backup boxes.
    >
    >>
    >> From: "Chris de Vidal" <chris@devidal.tv>
    >> Date: 2003/11/21 Fri PM 02:35:56 EST
    >> To: Bill@royds.net
    >> CC: firewall-wizards@honor.icsalabs.com
    >> Subject: Re: [fw-wiz] Wayyy too many spoofed packets
    >>
    >> Sorry if I misunderstand you, but you're saying it's normal for packets
    >> coming IN from the network to have my IP? See, that's my concern, not
    >> broadcasts.
    >>
    >> Netmask and broadcast match what you said:
    >> /sbin/ifconfig
    >> eth0 Link encap:Ethernet HWaddr 00:50:DA:0C:04:6E
    >> inet addr:172.19.2.200 Bcast:172.19.255.255 Mask:255.255.0.0
    >>
    >> Again, I'm only concerned about spoofed packets; packets coming from the
    >> outside in claiming to have my IP.
    >>
    >> So is this normal?
    >>
    >> /dev/idal
    >>
    >>
    >> Bill Royds said:
    >> > You have the default netmask set incorrectly (or not set at all) on
    >> host
    >> with IP 172.19.2.200. SMB uses broadcast by default if it has not been
    >> given a WINS address to find hosts and net 172.19.x.x is a class B which
    >> by default has a netmask of 255.255.0.0 and a broadcast address of
    >> 172.19.255.255.
    >> >
    >> > What you are seeing is perfectly normal for a Windows box with
    >> default
    >> > windows network setup (broadcast for name resolution).
    >> >
    >> >> From: "Chris de Vidal" <chris@devidal.tv>
    >> >> Date: 2003/11/21 Fri AM 10:27:36 EST
    >> >> To: firewall-wizards@honor.icsalabs.com
    >> >> Subject: [fw-wiz] Wayyy too many spoofed packets
    >> >> I'm going to be installing firewalls on my internal servers (yes, I'm
    >> paranoid) and right now I'm testing in flag-only mode (don't drop any
    >> packets) on one server. So-far, so-good, except every day I get about
    >> 150
    >> >> "spoofed" packets; packets claiming to be my IP coming INTO the NIC
    >> card.
    >> >> Strangely, the destination is always my network's broadcast address.
    >> Perhaps even more strangely is I'm seeing it only on SMB (UDP 137:138)
    >> and
    >> >> backup traffic (UDP 20031) ports.
    >> >> Here is the rule:
    >> >> /sbin/iptables -A bad_packets \
    >> >> -i eth0 -s 172.19.2.200 \
    >> >> --m limit --limit 3/minute \
    >> >> --j LOG --log-level INFO \
    >> >> --log-prefix "Spoofed packet type 1 (bad): "
    >> >> Here is the log:
    >> >> Logged 142 packets on interface eth0
    >> >> From 172.19.2.200 - 142 packets
    >> >> To 172.19.255.255 - 142 packets
    >> >> Service: netbios-ns (udp/137) (Spoofed packet type 1
    >> >> (bad):,eth0,none) - 19 packets
    >> >> Service: netbios-dgm (udp/138) (Spoofed packet type 1
    >> >> (bad):,eth0,none) - 103 packets
    >> >> (20031 is the backup port)
    >> >> Service: 20031 (udp/20031) (Spoofed packet type 1
    >> >> (bad):,eth0,none)
    >> >> - 20 packets
    >> >> Ideas?
    >> >> /dev/idal
    >> >> _______________________________________________
    >> >> firewall-wizards mailing list
    >> >> firewall-wizards@honor.icsalabs.com
    >> >> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >> >
    >> >
    >> >
    >>
    >>
    >>
    >> _______________________________________________
    >> firewall-wizards mailing list
    >> firewall-wizards@honor.icsalabs.com
    >> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >>
    >
    >
    >

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Mikael Olsson: "Re: [fw-wiz] Wayyy too many spoofed packets"

    Relevant Pages

    • Re: [SLE] Firewall zones (not fixed after all)
      ... On Saturday 30 September 2006 5:21 am, Darryl Gregorash wrote: ... Windows uses broadcasts extensively in its file sharing, ... Please see the firewall config file for a discussion of how this ... I fixed it just as you suggested and Samba ...
      (SuSE)
    • Re: Long Time Samba No Work-Need Expert Help On Samba/Networking
      ... The windows firewall has to be completely ... I tried the samba commands I listed on the ... added interface ip=127.0.0.1 bcast=127.255.255.255 ... server string = %h server ...
      (Ubuntu)
    • Re: [SLE] SUSE 9.3 Samba and Firewall issue
      ... > However I can access the windows boxes using their IP without any problems. ... > If I turn off the firewall on Linux Box I can also access the windows ... many tests to try to get a working Samba network. ... computer) with no improvements on the Linux side. ...
      (SuSE)
    • [HPADM] Re: Mapping Samba Share to XP
      ... My feeling is that the firewall is your problem. ... I was going to recommend you try mapping to a windows server on the ... > Made the changes to the smb.conf file and started samba server. ...
      (HP-UX-Admin)
    • Re: name all the uses for samba
      ... > I'm trying to tell him all the things that Samba will do, ... > freebsd, but we've still got a couple of domain servers to get rid of and I ... Get a firewall installed, get it ... Windows systems, their cost is obviously not a barrier to use. ...
      (freebsd-questions)