UDP packets from Apache ? New DDOS ?

From: Dave Foster (dave_at_canadian.net)
Date: 07/07/04

  • Next message: Bojan Zdrnja: "RE: UDP packets from Apache ? New DDOS ?" 
    To: <incidents@securityfocus.com>
Date: Wed, 7 Jul 2004 13:51:02 -0400

    Hi All,

    Some months ago, we notices a large amount of outbound traffic. Shutting
    down our Apache webserver, stopped it. After a restart, it never reoccurred,
    I assumed some glitch that was corrected by the restart. We did NOT have the
    SSL bug
    This morning, a system admin in Austria, informed me that his box was
    streaming UDP packets at us. This coincided with a major DDOS attack against
    us. Shutting down his Apache resolved the issue, and he is now temporarily
    blocking UDP from that host. He has provided a TCPdump to me, a portion of
    which follows. Can anyone shed some light, on what might be the cause, has
    it been seen before?

    07:40:52.116687 IP 192.168.1.106.49043 > 209.123.78.248.50567: UDP, =
    length: 1000
    0x0000: 4500 0404 0000 4000 4011 5463 c0a8 016a =
    E.....@.@.Tc...j 0x0010: d17b 4ef8 bf93 c587 03f0 2703 4242 4242 =
    .{N.......'.BBBB
    0x0020: 4242 4242 4242 4242 4242 4242 4242 4242 =
    BBBBBBBBBBBBBBBB
    0x0030: 4242 4242 4242 BBBBBB

    Dave Foster
    Systems Administrator, Canadian Net
    1-800-427-8564
    +1 416 245-1374
     UK 0870 3400558
     FAX +1 416 241-5274

  • Next message: Bojan Zdrnja: "RE: UDP packets from Apache ? New DDOS ?"

    Relevant Pages

    • Re: Diff. between Shutdown and Restart
      ... >>is similar to shutting down, only you don't have to turn it back on again. ... > system performs an orderly shutdown, ... > When you just press the reset button, the system will restart, but you ... > their state when you hit the reset button. ...
      (microsoft.public.windowsxp.general)
    • Re: Log Off VS Restart
      ... why would one want to RESTART at the end of the day? ... When a user is logged off, the system is still "Seeable" on the network. ... I think one of the answers would be "What is the companies security ... If security is an issue, then Shutting ...
      (microsoft.public.windowsxp.general)
    • Re: windows break down
      ... |>appears that says "windows is shutting down to prevent damage to computer" ... i have to unplug the power to restart my computer. ... occasionally the blue screen appears with an error message: ...
      (microsoft.public.windowsxp.general)
    • RE: Really slow shutdown w/E2K
      ... > FOREVER for this server to perform a restart. ... It's the shutting down thats super ... The total restart process ... > You'd think the reboot process would be much faster ...
      (microsoft.public.exchange2000.general)