RE: Help with an odd log file...

From: Golden Faron P Contr HQ SSG/SWSN (Faron.Golden_at_Gunter.AF.mil)
Date: 06/06/03

Next message: Roger A. Grimes: "Re: strange traffic on UDP port 53"

Previous message: Dayne Jordan: "IRC botnets"
Maybe in reply to: sec_slave_at_hushmail.com: "Help with an odd log file..."
Next in thread: Ken Eichman: "Re(2): Help with an odd log file..."
Reply: Ken Eichman: "Re(2): Help with an odd log file..."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Fri, 6 Jun 2003 10:55:25 -0500
To: <sec_slave@hushmail.com>, <intrusions@incidents.org>, <incidents@securityfocus.com>

Based on observations here, the strange packets are showing up
everywhere. Try running a capture that triggers on Window Size of 55808
and see what you find...Have been seeing a steadily increasing flow of
packets like the ones described below..Some interesting things are that
once a random source sends a SYN packet from a random port to a random
destination on a random host, the packet is repeated at irregular
intervals. Same source port, same source host, same destination host,
same destination port, same Sequence number, same window size...

Still no explanation

-----Original Message-----
From: sec_slave@hushmail.com [mailto:sec_slave@hushmail.com]
Sent: Tuesday, June 03, 2003 4:04 PM
To: intrusions@incidents.org; incidents@securityfocus.com
Subject: Help with an odd log file...

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello.

I am looking for some assistance in trying to identify the nature of
a suspected scan/attack against my corporate network.

The scan/attack includes spoofed source addresses that cover a wide
range
of IP networks. There is also a relationship between source and
destination addresses and ports for each entry. Each combination of
address and port information appears between 3 and 8 times, all trickled
in over a 3 day period. Normally, something like this might be
identified
as a TCP SYN SCAN, but the traffic is coming in too slowly and the
destination
ports are all upper level ports (as you can see).

The pattern is one with which I am not familiar and would appreciate
your assistance in identifying.

Thnx,

Sorted by source IP:

Date/Time Source IP/Port Dest IP/Port
May 25 13:53:48 2.66.161.64:55518 XX6.X37.153.7:61323
May 26 04:34:53 2.66.161.64:55518 XX6.X37.153.7:61323
May 26 23:29:58 2.66.161.64:55518 XX6.X37.153.7:61323
May 27 08:20:55 2.66.161.64:55518 XX6.X37.153.7:61323
May 27 15:39:08 2.66.161.64:55518 XX6.X37.153.7:61323
May 26 12:03:34 2.71.250.0:54845 XX6.X37.54.171:5929
May 26 20:54:18 2.71.250.0:54845 XX6.X37.54.171:5929
May 27 16:49:56 2.71.250.0:54845 XX6.X37.54.171:5929
May 25 06:18:33 2.86.7.241:56883 XX6.X37.41.151:21012
May 25 10:16:48 2.86.7.241:56883 XX6.X37.41.151:21012
May 26 05:04:11 2.86.7.241:56883 XX6.X37.41.151:21012
May 27 07:28:50 2.86.7.241:56883 XX6.X37.41.151:21012
May 27 15:37:04 2.86.7.241:56883 XX6.X37.41.151:21012
May 27 16:28:04 2.86.7.241:56883 XX6.X37.41.151:21012
May 27 10:11:14 2.95.43.255:12430 XX6.X37.29.228:9577
May 25 08:30:38 2.95.43.255:12430 XX6.X37.29.228:9577
May 26 07:56:32 2.95.43.255:12430 XX6.X37.29.228:9577
May 26 18:55:34 2.95.43.255:12430 XX6.X37.29.228:9577
May 26 20:22:41 2.95.43.255:12430 XX6.X37.29.228:9577
Etc.

---break for brevity's sake---
6353 lines removed

May 26 05:38:31 221.237.154.247:45635 XX6.X37.48.56:8199
May 26 08:13:10 221.237.154.247:45635 XX6.X37.48.56:8199
May 26 09:23:33 221.237.154.247:45635 XX6.X37.48.56:8199
May 26 17:30:12 221.237.154.247:45635 XX6.X37.48.56:8199
May 27 09:55:22 221.237.154.247:45635 XX6.X37.48.56:8199
May 25 18:02:24 222.6.30.78:55945 XX6.X37.12.103:32430
May 26 23:28:25 222.6.30.78:55945 XX6.X37.12.103:32430
May 27 03:23:43 222.6.30.78:55945 XX6.X37.12.103:32430
May 26 09:12:56 222.12.8.159:40062 XX6.X37.39.135:43096
May 26 23:02:06 222.12.8.159:40062 XX6.X37.39.135:43096
May 26 23:53:30 222.12.8.159:40062 XX6.X37.39.135:43096
May 27 13:32:13 222.12.8.159:40062 XX6.X37.39.135:43096
May 26 12:28:58 222.20.24.164:3281 XX6.X37.21.175:27751
May 26 21:26:42 222.20.24.164:3281 XX6.X37.21.175:27751
May 26 22:10:47 222.20.24.164:3281 XX6.X37.21.175:27751
May 27 11:04:40 222.20.24.164:3281 XX6.X37.21.175:27751
May 27 13:31:51 222.20.24.164:3281 XX6.X37.21.175:27751
May 27 15:36:37 222.20.24.164:3281 XX6.X37.21.175:27751
Etc.

Captured Frame Sample:

Frame 1 (66 bytes on wire, 66 bytes captured)
    Arrival Time: May 27, 2003 14:13:58.220746000
    Time delta from previous packet: 0.000000000 seconds
    Time relative to first packet: 0.000000000 seconds
    Frame Number: 1
    Packet Length: 66 bytes
    Capture Length: 66 bytes
Ethernet II, Src: 00:00:0c:95:72:bd, Dst: 00:60:91:0b:45:35
    Destination: 00:60:98:0d:45:35 (3Com_0d:45:35)
    Source: 00:00:0c:95:78:bd (Cisco_95:78:bd)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 155.128.250.228 (155.128.250.228), Dst
Addr:
XX6.X37.151.97 (XX6.X37.151.97)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 52
    Identification: 0xb82b
    Flags: 0x00
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 118
    Protocol: TCP (0x06)
    Header checksum: 0xc248 (correct)
    Source: 155.128.250.228 (155.128.250.228)
    Destination: XX6.X37.151.97 (XX6.X37.151.97)
Transmission Control Protocol, Src Port: 866 (866), Dst Port: 26469
(26469),
Seq: 1409168989, Ack: 0, Len: 0
    Source port: 866 (866)
    Destination port: 26469 (26469)
    Sequence number: 1409168989
    Header length: 32 bytes
    Flags: 0x0002 (SYN)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...0 .... = Acknowledgment: Not set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..1. = Syn: Set
        .... ...0 = Fin: Not set
    Window size: 55808
    Checksum: 0xd5a2 (correct)
    Options: (12 bytes)
        Maximum segment size: 1460 bytes
        NOP
        Window scale: 2 (multiply by 4)
        NOP
        NOP
        SACK permitted
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.3

wkYEARECAAYFAj7dDSgACgkQbTw24P1BTGJXaQCgsLPS0niweOjKLZSIRKUVWioqoTAA
oIDwlD0AxJojtPAhIdlunJmyAG1R
=US/J
-----END PGP SIGNATURE-----

Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Big $$$ to be made with the HushMail Affiliate Program:
https://www.hushmail.com/about.php?subloc=affiliate&l=427

------------------------------------------------------------------------

----
------------------------------------------------------------------------
----
----------------------------------------------------------------------------
----------------------------------------------------------------------------

Next message: Roger A. Grimes: "Re: strange traffic on UDP port 53"

Previous message: Dayne Jordan: "IRC botnets"
Maybe in reply to: sec_slave_at_hushmail.com: "Help with an odd log file..."
Next in thread: Ken Eichman: "Re(2): Help with an odd log file..."
Reply: Ken Eichman: "Re(2): Help with an odd log file..."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

IPFilter 5.0.0 - feedback?
... rewrite - change both source and address fields for incoming or ... encap - encapsulated the packet in a new IP header (this will be ... encap is pretty much the same as divert, minus the port numbers to ... REWRITING SOURCE AND DESTINATION ...
(freebsd-net)
PATCH: Remove file riowinif.h from rio driver (unused file)
... -/* The RUP (Remote Unit Port) structure relates to the Remote Terminal Adapters ... - CONFIG is sent from the driver to configure an already opened port. ... - Packet structure is same as OPEN. ... - of the specified port's RTA address space. ...
(Linux-Kernel)
Re: how to connect firewall to router
... >> lan side and this port is the firewall port, ... > to their intended destination based on the IP packet's network. ... > As a packet travels through various relay points, ... It becomes a map of how the destination should respond. ...
(comp.security.firewalls)
Re: General questions about Sockets
... > could I push it before I see the network slowing down and/or errors? ... Nagle/Delayed ACK interaction but you could confirm it with a packet ... > I can setup any port in my registry, but what would be the 'default' one I ... Google could confirm it. ...
(microsoft.public.win32.programmer.networks)
Re: preliminary conclusions regarding window size issues
... Indeed fiddly - not only does the packet have to disappear, ... Another thought that ocurred to me is that this might be a window tracking ... TCP port 514 is rsh, but when I try rsh on that port it doesn't work. ...
(Linux-Kernel)