Re: udp and dst port 1026

From: Bill McCarty (bmccarty_at_pt-net.net)
Date: 12/02/03

  • Next message: James C. Slora Jr.: "Re: Same sequence..." 
    Date: Mon, 01 Dec 2003 19:54:55 -0800
To: Jens Hektor <hektor@rz.rwth-aachen.de>, incidents@securityfocus.com

    Hi Hektor and all,

    --On Tuesday, December 02, 2003 12:20 AM +0100 Jens Hektor
    <hektor@rz.rwth-aachen.de> wrote:

    > starting around Nov 22 and increasing from Nov 24
    > until today I see packets floating around from
    > various sources to almost any IP of our networks.
    > Payload are two bytes with value zero.
    > Any idea what this could be?

    I've been tracking apparently identical traffic for several days and
    there's been discussion of it on the DShield email list. In particular, I'm
    seeing 0x0000 payloads delivered to UDP 135 and UDP 1026-1031. The same
    sources sometimes also send a standard, 50-byte NetBIOS probe to UDP 137.

    Over each of the last several days, I've seen scans by several hundred
    hosts of one host on my Class C. That host, a Red Hat Linux honeypot, has
    provided little encouragement to the scanners, since it responds with ICMP
    Port Unreachable to all the related traffic. About midday today, additional
    hosts on my network were targeted and the scans began to strongly favor UDP
    1026 and UDP 1030, whereas they'd earlier generally included all ports in
    the UDP 1026-1031 range. DShield graphs of the number of UDP 1026 and UDP
    1030 targets went vertical today, so this is apparently an Internet-wide
    phenomenon.

    I still see no payloads other than 0x0000. I speculate that I'm monitoring
    the scanning phase of a soon-to-be worm or worms, and that some more
    interesting payload will soon arrive. My guess is that the payload will
    target the Windows Messenger service, which is generally available on the
    ports being probed.

    One participant on the DShield list has a pair of local hosts that today
    began emitting UDP 1026-1031 traffic from his .edu network. He plans to
    obtain and analyze them tomorrow. Perhaps his efforts will shed light on
    the traffic.

    Cheers,

    ---------------------------------------------------
    Bill McCarty

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: James C. Slora Jr.: "Re: Same sequence..."

    Relevant Pages

    • Re: how to control UDP sending Speed?
      ... IPQAM device is 10000Mbps. ... The IPQAM device only can accept a constant bit rate udp TS(mpeg2 transport ... stream) data stream for broadcasting TV. ... Does the sender get any feedback whatsoever regarding the state or status of the IPQAM device, and/or any other components in the network involved in transmitting the data? ...
      (microsoft.public.dotnet.framework)
    • Re: UDP packets are dropped by the PIX
      ... >>personal use of city property. ... 165.155.0.0/16 is the public schools. ... >available recommended standard, IPSec, relies upon UDP. ... have access to some network stuff, even though I'm a network guy. ...
      (comp.security.firewalls)
    • Re: send(2) does not block, send(2) man page wrong?
      ... >> can't drain the data fast enough. ... >> blocking and releasing would be a little bit harder to do for UDP. ... Which is the same result as you would get if the bottleneck is just one ... network hop away instead of at the local NIC. ...
      (freebsd-hackers)
    • Re: Kerberos UDP vs TCP
      ... Various network devices and improperly configured network cards are what I most often see screwing up the UDP packet delivery. ... TCP does add a good amount of overhead and I would recommend doing a network impact study before considering switching whole hog to TCP. ...
      (microsoft.public.security)
    • Re: Seeing large amounts of data on udp recv-q, only sending 1 byte of data
      ... The first app sends a user defined ... recv side and the udp packet there had just the data I sent. ... The extra data is the source of the payload. ...
      (comp.os.linux.networking)