Re: Strange attack question - seems udp

From: *** St.Peters (stpeters_at_NetHeaven.com)
Date: 10/17/05

  • Next message: Mihai Tanasescu: "Re: Strange attack question - seems udp" 
    Date: Mon, 17 Oct 2005 15:54:45 -0400
To: "'Mihai Tanasescu'" <mihai@duras.ro>, <incidents@securityfocus.com>

    This probably wasn't an intentional "attack", it was probably just
    someone using NFS. The posted tcpdump output looks *exactly* like
    part of an NFS read by 70.84.247.164 of a file mounted from
    86.104.102.16.

    Here's part of a tcpdump output on a Linux router for an NFS copy when
    198.69.28.162 has a filesystem mounted from 208.20.133.4:

    15:05:31.807546 IP (tos 0x0, ttl 63, id 6093, offset 11840, flags [+],
    length: 1500) 208.20.133.4 > 198.69.28.162: udp
    15:05:31.807549 IP (tos 0x0, ttl 63, id 6093, offset 13320, flags [+],
    length: 1500) 208.20.133.4 > 198.69.28.162: udp
    15:05:31.807554 IP (tos 0x0, ttl 63, id 6093, offset 14800, flags [+],
    length: 1500) 208.20.133.4 > 198.69.28.162: udp
    15:05:31.807558 IP (tos 0x0, ttl 63, id 6093, offset 16280, flags [+],
    length: 1500) 208.20.133.4 > 198.69.28.162: udp
    15:05:31.807561 IP (tos 0x0, ttl 63, id 6093, offset 17760, flags [+],
    length: 1500) 208.20.133.4 > 198.69.28.162: udp
    15:05:31.807567 IP (tos 0x0, ttl 63, id 6093, offset 19240, flags [+],
    length: 1500) 208.20.133.4 > 198.69.28.162: udp

    I don't have a Cisco 3750, but I do have a 3640, and trying the above
    copy through my 3640 would choke it.

    Modern NFS does 32KB writes by default, and these result in rapid fire
    trains of 23 udp fragments sent as fast as the kernel can spew them
    out. Ciscos don't seem to be able to handle this. (It will also
    choke some RealTek-based NICs.)

    Older NFS uses 8KB writes, meaning trains of 6 fragments. These too
    will sometimes choke Ciscos and certain RealTek-based NICs. 

    --
*** St.Peters, stpeters@NetHeaven.com 
Gatekeeper, NetHeaven, Saratoga Springs, NY
-----Original Message-----
From: Mihai Tanasescu [mailto:mihai@duras.ro] 
Sent: Thursday, October 13, 2005 1:09 PM
To: incidents@securityfocus.com
Subject: Strange attack question - seems udp
Hello,
I've been getting things like these recently:
21:00:52.941148 IP (tos 0x0, ttl 127, id 28639, offset 11840, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp
21:00:52.941271 IP (tos 0x0, ttl 127, id 28639, offset 13320, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp
21:00:52.941394 IP (tos 0x0, ttl 127, id 28639, offset 14800, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp
21:00:52.941517 IP (tos 0x0, ttl 127, id 28639, offset 16280, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp 21:00:52.941640 IP (tos
0x0, ttl 127, id 28639, offset 17760, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp
I have 24 subnets inside a Cisco 3750.
After receiving many packets like these on 3-4 interfaces, Cisco starts
loosing packets and acts abnormal.
I have gathered the output show above from a Linux machine with tcpdump 
which acts as a border router.
  • Next message: Mihai Tanasescu: "Re: Strange attack question - seems udp"
    • Quantcast