RE: Strange attack question - seems udp

From: David Gillett (gillettdavid_at_fhda.edu)
Date: 10/17/05

  • Next message: crusher_at_spamcop.net: "Odd Increase in Malformed Packets Aimed at Port 0" 
    To: "'Mihai Tanasescu'" <mihai@duras.ro>, <incidents@securityfocus.com>
Date: Mon, 17 Oct 2005 08:43:16 -0700

      Since the 1500 size is almost certainly an MTU, I'll guess
    that those "offset" numbers are indicating that this is an
    IP layer fragment; the UDP header information (including port
    numbers) is at offset 0 and so is not available when examining
    these fragments.

      There used to be a common brute-force DoS, often implemented
    in VBasic, that went something like

      allocate buf[64K bytes]
      send to target
        repeat until killed

      In my experience, the "send to target" was usually done with
    ICMP rather than UDP, but that's an implementation detail. The
    point was that this punted slicing of the buffer by MTU to the
    IP layer, which is what you're seeing.

      IP-layer fragmentation is a very bad idea, not least because
    the fragments have inadequate header information. As you've found,
    the reassembly process is rarely really robust, and can be subject
    to DoS problems of its own. So when you say

    > After receiving many packets like these on 3-4 interfaces,
    > Cisco starts loosing packets and acts abnormal.

    I'm not terribly surprised.

    REMEDY: You can add an access list (or a line to your existing
    access list) to block fragments. Anybody who really cares about
    talking to you will either do PMTUD or set a sane MTU. These big
    fragments will still try to take up your bandwidth (talk to your
    ISP about blocking them upstream), but your router will be stable.

    David Gillett

    > -----Original Message-----
    > From: Mihai Tanasescu [mailto:mihai@duras.ro]
    > Sent: Thursday, October 13, 2005 11:09 AM
    > To: incidents@securityfocus.com
    > Subject: Strange attack question - seems udp
    >
    > Hello,
    >
    > I've been getting things like these recently:
    >
    > 21:00:52.941148 IP (tos 0x0, ttl 127, id 28639, offset 11840,
    > flags [+],
    > length: 1500) 86.104.102.16 > 70.84.247.164: udp
    > 21:00:52.941271 IP (tos 0x0, ttl 127, id 28639, offset 13320,
    > flags [+],
    > length: 1500) 86.104.102.16 > 70.84.247.164: udp
    > 21:00:52.941394 IP (tos 0x0, ttl 127, id 28639, offset 14800,
    > flags [+],
    > length: 1500) 86.104.102.16 > 70.84.247.164: udp
    > 21:00:52.941517 IP (tos 0x0, ttl 127, id 28639, offset 16280,
    > flags [+],
    > length: 1500) 86.104.102.16 > 70.84.247.164: udp
    > 21:00:52.941640 IP (tos 0x0, ttl 127, id 28639, offset 17760,
    > flags [+],
    > length: 1500) 86.104.102.16 > 70.84.247.164: udp
    >
    >
    > I have 24 subnets inside a Cisco 3750.
    >
    > After receiving many packets like these on 3-4 interfaces,
    > Cisco starts loosing packets and acts abnormal.
    >
    >
    > I have gathered the output show above from a Linux machine
    > with tcpdump
    > which acts as a border router.
    >
    > What I find strange is that there is no port specified (src,dst) and
    > that the length of the packets is always 1500.
    >
    > Is there any way to filter something like this on the Cisco switch ?
    >
    > Is it caused by a virus or by a human ? (I have seen it from 3-4
    > different interfaces at a time and with 4-6 different destination IPs)
    >
    >
    > Any help will be greatly appreciated.
    >
    >
    > Sorry if I have posted this to the wrong list.
    >

  • Next message: crusher_at_spamcop.net: "Odd Increase in Malformed Packets Aimed at Port 0"

    Relevant Pages

    • RE: streams of fragments...
      ... You could get around this by setting the MTU to 1480, ... This also has the added bonus of reducing the network ... There wouldn't be any harm in blocking all fragmented packets, ... You could counter this by blocking all IP fragments on your ...
      (Incidents)
    • MTU setting and PPPoe connection
      ... A few days ago I had posted that I was having problem on computers on my ... The problem was that the LAN laptop was working with MTU=1500. ... I tried putting "mtu 1490" in /etc/network/interfaces but that doesn't ... # I have to say that fragments scare me more than anything. ...
      (comp.os.linux.networking)
    • Re: Sonicwall Problem
      ... > success with forcing my WAN Port to be 10 Mbps Full Duplex. ... > outbound packets larger then WAN MTU which is set to 1500. ... OK, what about INBOUND fragments? ... incoming fragmented packets i think. ...
      (comp.security.firewalls)
    • RE: help with network problem
      ... However, gang, I really thing that the MTU issue is a false flag. ... Say Irene's path has an MTU of 1500, except for one wanky router that's at ... And they travel the rest of the way that way (as separate fragments) until ... I remain convinced that the mit bbs is specifically blocking Irene or her IP ...
      (Security-Basics)
    • Re: Strange attack question - seems udp
      ... I'll try to filter out fragments on the Cisco to see what happens. ... >>Cisco starts loosing packets and acts abnormal. ... >>which acts as a border router. ...
      (Incidents)
    • Quantcast