Re: Mail DoS from Bellsouth

From: crawdog (c.nishimura@verizon.net)
Date: 08/21/02 

From: crawdog <c.nishimura@verizon.net>
Date: Wed, 21 Aug 2002 04:40:51 GMT

LR wrote:
> I'm confused about the number of (SMTP-bound) packets originating from
> Bellsouth's network to my mail server. I had to block their IP range to
> prevent my server from being completely overloaded. Initially I would think
> this the work of a spammer, but there are 30+ bellsouth mail servers
> attempting connection to my box multiple times/second constantly for the
> last week. I can't fathom that bellsouth would be so incompetant as to let
> this happen, but I've gotten no response from abuse@ so I s'pose it's
> possible. A log sample is below...has anyone seen this before?
>
> Aug 20 07:04:02 server kernel: Packet log: input DENY eth0 PROTO=6
> 205.152.58.163:30669 xx.xx.xx.xx:25 L=44 S=0x00 I=14886 F=0x4000 T=238 SYN
> (#2)
> Aug 20 07:04:07 server kernel: Packet log: input DENY eth0 PROTO=6
> 205.152.58.48:55261 xx.xx.xx.xx:25 L=44 S=0x00 I=53501 F=0x4000 T=238 SYN
> (#2)
> Aug 20 07:04:08 server kernel: Packet log: input DENY eth0 PROTO=6
> 205.152.58.163:30669 xx.xx.xx.xx:25 L=44 S=0x00 I=14887 F=0x4000 T=238 SYN
> (#2)
> Aug 20 07:04:10 server kernel: Packet log: input DENY eth0 PROTO=6
> 205.152.58.52:62693 xx.xx.xx.xx:25 L=44 S=0x00 I=7213 F=0x4000 T=238 SYN
> (#2)
>
> TIA,
> LR

Let's see. As Tim mentioned TCP connections go by a 3,6,12,... second
time interval. The two connection attempts from 205.152.58.163 is 6
seconds apart. Additionally, the packet id # increments up by one
(14886, 14887). This is a very quiet tcp stack. This is likely to be a
TCP connection attempt from a very quiet client.

However, there are other smtp connection attempts. No real pattern
except the TTL (238) are all the same. Your e-mail hdr indicates
acedsl.com, which is on the US east coast(?). Bellsouth is on the other
side of N.A. so the TTL is likely legit (assuming a init TTL value of
about 255).

Someone mention Klez. This is possible. If so, this means that a bunch
of people on bellsouth are sending klez to a bunch of user on your
network; bellsouth user(s) has your folks in their address book. One
thing to check are the time stamps. Early morning e-mail from bellsouth
are unlikely unless the source is a nightowl.

Someone mentioned spam. Sort of smells like spam.

Hard to figure out without seeing more or your logs. However, I can
speculate. A while back, one Manfred Bartz (sp?) used to correct me when
ever I misread the logs. OT: WTF is Manfred doing? (Tim?, Luke?) What
happened to one Mr. Erskine, queen:-) of this ng?

Clyde

Relevant Pages

  • Re: getting/sending email when travelling
    ... or if they're on a network that has access to the web in another ... > outlook account doesn't work. ... What's the IP address or FQDN of the mail server they're trying to connect ... > I was under the impression that as long as there was a connection to ...
    (microsoft.public.outlook)
  • Re: relay access denied
    ... GK> has a mail server and B doesn't. ... GK> and only one machine, say MAX-B, on network B. ... But the ssh man page for -L says "Whenever a connection is made to this ... connection is made to host port hostport from the remote machine" ...
    (comp.mail.misc)
  • Physical vs. Virtual iface device vulnerability
    ... If I connect my outside switch to my inside switch and give an outside ... I would like to implement Dspam on my mail server. ... outside my internal network with its own firewall in place. ... server an internal ip address and set up connection to MySQL on the inside ...
    (Security-Basics)
  • getting/sending email when travelling
    ... I set up the email account for a few salesmen in our company - I used the IP ... address of our mail server (not sure if it's Esxchange or not, ... However, from anywhere outside the network, they get the "tcp/ip connection ...
    (microsoft.public.outlook)
  • Re: Mail DoS from Bellsouth
    ... > I'm confused about the number of packets originating from ... > Bellsouth's network to my mail server. ... I can't fathom that bellsouth would be so incompetant as to let ...
    (comp.os.linux.security)