Re: Tons of Source port 80 to random Dest Port Traffic

["Tom Hayden" <haydenth () msu edu>]

Matthew,

Thanks for looking at the traffic. At first, I was thinking a similar
thing that you were, but this is where I get kind of baffled.

Q1: Ethereal yields *no* outgoing traffic.  Additionally, the traffic
I sent earlier continues.  There are about 5-10 different IP's (all
from the same consumer DSL equipment) that have a src port of 80 and a
constant dest. port.  For example. The host 211.7.246.248 *always*
sends a src 80 dest 3509 SYN,ACK packet.
Q2: Host is not a proxy, just a firewalled webserver with only port 80
and 25 open.

Cheers,

Tom

On 5/20/06, Mathew Benwell <mjbenny () internode on net> wrote:
>  Hi Tom,
>
>  I have had a quick look at the ip addresses and on first glance they seem
> to be consumer dsl services.
>
>  Q1. Are there any SYN packets in the capture heading in the other direction
> to the same hosts on the same port combination?
>  Q2. Is this host a proxy server?
>
>  If its legitimate traffic:
>  The SYN, ACK is the first reply packet when attempting to establish a TCP
> session after the original SYN packet. This would suggest that the first
> packet originated from your host. The static source port of 80 also suggests
> that the traffic originated from your host, probably trying to access a web
> server. Becuase of the way tcp works, there is always a need for a return
> port for traffic coming back to your host. This port is almost always a
> random port above 1024, which if you get enough packet captures you will
> notice that it usually increments upwards. This is what the packet would
> suggest if the world was all rosey.
>
>  If I were suspicious of the traffic (Which I am atm):
>  From Q1, Q2, If the host is not a proxy server and there are SYN packets.
> This could mean:
>      a). You have been compromised by a trojan/virus on the host which is
> trying to call home/propogate.
>      b). Your host may be compromised and it is launching attacks against
> other hosts. Maybe a particular make and model of DSL router.
>  From Q1, if there were no SYN packets, it could be a DDoS
>
>  A more accurate idea could be gained from more packets from the
> conversation. e.g. the full SYN, SYN ACK, ACK as well as any packets from
> the same session.
>
>  Anyway, not trying to alarm you, but I hope that helps.
>
>  Cheers
>  Mat
>
>
>  Tom Hayden wrote:
> Attached is a quick short summary of traffic my server ( xx.xx.xx.xx )
>  has been bombarded with lately.  It's a short dump from tethereal.  I
>  can't seem to figure it out - just tons and tons of traffic coming
>  from a source port of 80 to seemingly random dest. ports.  Can someone
>  help me identify this?
>
>  Thanks!
>
>  --
>  Tom
>
> ________________________________
>
>  0.000000 205.179.98.153 -> xx.xx.xx.xx TCP www > 1088 [SYN, ACK] Seq=0
> Ack=1 Win=4096 Len=0 MSS=1024
>  0.156106 205.179.163.118 -> xx.xx.xx.xx TCP www > 1501 [SYN, ACK] Seq=0
> Ack=1 Win=4096 Len=0 MSS=1024
>  0.623511 205.179.12.122 -> xx.xx.xx.xx TCP www > 3041 [SYN, ACK] Seq=0
> Ack=1 Win=4096 Len=0 MSS=1024
>  0.643203 65.217.140.2 -> xx.xx.xx.xx TCP www > 3198 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>  0.994720 66.89.134.52 -> xx.xx.xx.xx TCP www > 1562 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>  1.345049 205.179.149.129 -> xx.xx.xx.xx TCP www > 1944 [SYN, ACK] Seq=0
> Ack=1 Win=4096 Len=0 MSS=1024
>  1.851040 12.100.155.209 -> xx.xx.xx.xx TCP www > 4062 [SYN, ACK] Seq=0
> Ack=1 Win=4096 Len=0 MSS=1024
>  2.818835 12.102.14.52 -> xx.xx.xx.xx TCP www > 4813 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>  3.704693 64.0.131.17 -> xx.xx.xx.xx TCP www > 3444 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>  3.861277 12.102.14.94 -> xx.xx.xx.xx TCP www > 4863 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>  4.583619 209.114.238.97 -> xx.xx.xx.xx TCP www > 3798 [SYN, ACK] Seq=0
> Ack=1 Win=4096 Len=0 MSS=1024
>  4.594220 66.89.134.50 -> xx.xx.xx.xx TCP www > 1560 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>  5.270704 12.102.56.76 -> xx.xx.xx.xx TCP www > 4400 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>  6.319898 209.114.245.90 -> xx.xx.xx.xx TCP www > 1678 [SYN, ACK] Seq=0
> Ack=1 Win=4096 Len=0 MSS=1024
>  6.545658 211.7.246.248 -> xx.xx.xx.xx TCP www > 3509 [SYN, ACK] Seq=0 Ack=1
> Win=1024 Len=0 MSS=512 TSV=4157351006 TSER=42941574 WS=0
>  6.584370 64.93.0.193 -> xx.xx.xx.xx TCP www > 3371 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>  6.685362 12.98.248.241 -> xx.xx.xx.xx TCP www > 2672 [SYN, ACK] Seq=0 Ack=1
> Win=4096 Len=0 MSS=1024
>
>  ________________________________
>
> No virus found in this incoming message.
> Checked by AVG Free Edition.
> Version: 7.1.392 / Virus Database: 268.6.1/344 - Release Date: 19/05/2006