DDoS attack.

From: Daniel F. Chief Security Engineer - (danielf@supportteam.net)
Date: 01/25/02 

From: "Daniel F. Chief Security Engineer -" <danielf@supportteam.net>
To: incidents@securityfocus.com
Date: Fri, 25 Jan 2002 12:23:26 -0600

Im looking for help tracing this attack down. Its coming from my network with
spoofed IPs to 216.200.108.194 IP which is not on my network so its and
outbound attack. Also none of the source IPs are on my network.

I have blocked the outgoing traffic at the firewalls so it is not leaving my
network.

Here is a short tcpdump if the traffic.
11:34:50.660747 43.150.52.83.24630 > 216.200.108.194.5371: S
1667351577:1667351577(0) win 65535
11:34:50.661041 54.216.84.23.29249 > 216.200.108.194.5372: S
1116047630:1116047630(0) win 65535
11:34:50.661420 255.8.148.250.22903 > 216.200.108.194.5377: S
2101768472:2101768472(0) win 65535
11:34:50.661762 226.66.36.238.2498 > 216.200.108.194.5378: S
1399051237:1399051237(0) win 65535
11:34:50.661910 98.139.159.60.41527 > 216.200.108.194.5379: S
417777474:417777474(0) win 65535

It got all the signs of a dDoS attack window size is always the same dst
ports are incrementing by one every time. and the source IP is randomized. I
cannot fine the machine(s) that are generating this as I have a very large
interconnected(cluster $#@!) network that inherited which comatins well over
1600 hosts.

TIA

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Quantcast