Full Disclosure mailing list archives
Re: Odd packet?
From: Valentino Squilloni - Ouz <ouz () people it>
Date: Thu, 27 May 2004 20:07:22 +0200 (CEST)
On Wed, 26 May 2004, Mike Klinke wrote: [...]
Even the OP didn't mentioned this. I'm proned to believe those packets have 127.0.0.1 as the source of the packets.You're correct. I thought I'd sent this to the list last night but didn't watch the to: field carefully enough on my reply. I don't know the mechanism but I think I know what you were seeing. Here is an ethereal packet capture from the time. We, too, were constantly seeing our ISP controlled perimeter router sending these packets to our internal equipment. The source MAC address here is the perimeter router (Cisco 1700) and the ISP was pretty much stumped over the cause.
[...]
Internet Protocol, Src Addr: 127.0.0.1 (127.0.0.1), Dst Addr: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx) Time to live: 121 Protocol: TCP (0x06) Src Port: 80 (80), Dst Port: 1319 (1319), Seq: 0, Ack: 986251265, Len: 0 Source port: 80 (80) Destination port: 1319 (1319) Flags: 0x0014 (RST, ACK)
Ok. It seems the case described. A spoofed packet with your IP as the source tries to connect to the compromised machine to port 80 at localhost. The compromised machine doesn't have a webserver listening at 127.0.0.1:80 so the tcp stack replyes ACK RST and sends this packet to your spoofed address. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Odd packet?, (continued)
- Re: Odd packet? Valdis . Kletnieks (May 26)
- Re: Odd packet? Steffen Schumacher (May 26)
- Re: Odd packet? Jeff Kell (May 26)
- Re: Odd packet? Valdis . Kletnieks (May 26)
- Re: Odd packet? Steffen Schumacher (May 26)
- RE: Odd packet? Aditya, ALD [Aditya Lalit Deshmukh] (May 26)
- Re: Odd packet? Steffen Schumacher (May 27)
- Message not available
- Re: Odd packet? Valentino Squilloni - Ouz (May 26)
- Re: Odd packet? Steffen Schumacher (May 26)
- Re: Odd packet? Mike Klinke (May 26)
- Message not available
- Re: Odd packet? Valentino Squilloni - Ouz (May 27)
- Re: Odd packet? Valentino Squilloni - Ouz (May 25)
- Re: Odd packet? Maarten (May 25)
- Message not available
- Re: Odd packet? Valentino Squilloni - Ouz (May 26)
- Re: Odd packet? Gregh (May 25)