Security Incidents mailing list archives
Re: Strange attack question - seems udp
From: "Dick St.Peters" <stpeters () NetHeaven com>
Date: Mon, 17 Oct 2005 15:54:45 -0400
This probably wasn't an intentional "attack", it was probably just someone using NFS. The posted tcpdump output looks *exactly* like part of an NFS read by 70.84.247.164 of a file mounted from 86.104.102.16. Here's part of a tcpdump output on a Linux router for an NFS copy when 198.69.28.162 has a filesystem mounted from 208.20.133.4: 15:05:31.807546 IP (tos 0x0, ttl 63, id 6093, offset 11840, flags [+], length: 1500) 208.20.133.4 > 198.69.28.162: udp 15:05:31.807549 IP (tos 0x0, ttl 63, id 6093, offset 13320, flags [+], length: 1500) 208.20.133.4 > 198.69.28.162: udp 15:05:31.807554 IP (tos 0x0, ttl 63, id 6093, offset 14800, flags [+], length: 1500) 208.20.133.4 > 198.69.28.162: udp 15:05:31.807558 IP (tos 0x0, ttl 63, id 6093, offset 16280, flags [+], length: 1500) 208.20.133.4 > 198.69.28.162: udp 15:05:31.807561 IP (tos 0x0, ttl 63, id 6093, offset 17760, flags [+], length: 1500) 208.20.133.4 > 198.69.28.162: udp 15:05:31.807567 IP (tos 0x0, ttl 63, id 6093, offset 19240, flags [+], length: 1500) 208.20.133.4 > 198.69.28.162: udp I don't have a Cisco 3750, but I do have a 3640, and trying the above copy through my 3640 would choke it. Modern NFS does 32KB writes by default, and these result in rapid fire trains of 23 udp fragments sent as fast as the kernel can spew them out. Ciscos don't seem to be able to handle this. (It will also choke some RealTek-based NICs.) Older NFS uses 8KB writes, meaning trains of 6 fragments. These too will sometimes choke Ciscos and certain RealTek-based NICs. -- Dick St.Peters, stpeters () NetHeaven com Gatekeeper, NetHeaven, Saratoga Springs, NY -----Original Message----- From: Mihai Tanasescu [mailto:mihai () duras ro] Sent: Thursday, October 13, 2005 1:09 PM To: incidents () securityfocus com Subject: Strange attack question - seems udp Hello, I've been getting things like these recently: 21:00:52.941148 IP (tos 0x0, ttl 127, id 28639, offset 11840, flags [+], length: 1500) 86.104.102.16 > 70.84.247.164: udp 21:00:52.941271 IP (tos 0x0, ttl 127, id 28639, offset 13320, flags [+], length: 1500) 86.104.102.16 > 70.84.247.164: udp 21:00:52.941394 IP (tos 0x0, ttl 127, id 28639, offset 14800, flags [+], length: 1500) 86.104.102.16 > 70.84.247.164: udp 21:00:52.941517 IP (tos 0x0, ttl 127, id 28639, offset 16280, flags [+], length: 1500) 86.104.102.16 > 70.84.247.164: udp 21:00:52.941640 IP (tos 0x0, ttl 127, id 28639, offset 17760, flags [+], length: 1500) 86.104.102.16 > 70.84.247.164: udp I have 24 subnets inside a Cisco 3750. After receiving many packets like these on 3-4 interfaces, Cisco starts loosing packets and acts abnormal. I have gathered the output show above from a Linux machine with tcpdump which acts as a border router.
Current thread:
- Strange attack question - seems udp Mihai Tanasescu (Oct 17)
- Re: Strange attack question - seems udp Carles Fragoso i Mariscal (Oct 17)
- Re: Strange attack question - seems udp Mihai Tanasescu (Oct 19)
- Re: Strange attack question - seems udp Christoph Gruber (Oct 24)
- Re: Strange attack question - seems udp Mihai Tanasescu (Oct 19)
- RE: Strange attack question - seems udp David Gillett (Oct 17)
- Re: Strange attack question - seems udp Mihai Tanasescu (Oct 19)
- <Possible follow-ups>
- RE: Strange attack question - seems udp Joshua Berry (Oct 17)
- Re: Strange attack question - seems udp Dick St.Peters (Oct 19)
- Re: Strange attack question - seems udp Carles Fragoso i Mariscal (Oct 17)