Connection attempts with source port 113

[Rainer.Ginsberg () DE BOSCH COM (Ginsberg Rainer (QI/INF4) *)]

Hello,

at our packet filter, I see a lot of connection attempts from various
source addresses to unused addresses of our address blocks with source
port 113. The destination port is always one of the following.

- 1124
- 1269
- 1310
- 1415
- 1455
- 1560

Sometimes it's just one packet from one source address, sometimes it's
a whole bunch from one source to different destinations.

My guess is that these are replies to SYN floods, where the attacker used
our unused addresses for spoofing.

Does anybody else see something similar? What are your conclusions? Why
would someone try to flood identd?

Regards,
Rainer

--
Rainer Ginsberg
Robert Bosch GmbH
QI/INF4, IT security
Phone: +49-711-811-31263