Security Incidents mailing list archives

Strange Happenings @Home


From: fhirsch () TSE COM (Fred Hirsch)
Date: Tue, 30 May 2000 10:28:33 -0400


I run a Linux IP-masqueraded firewall for a small home network from within
the
@Home domain. This same system hosts my small consulting web site as well.
I recently moved from one @Home provider (Shaw-Canada) to another
(Rogers-Canada). Once I got my firewall system up and running, I was
receiving
hundreds of denyable packets. Within 4 days, my firewall logs were 90MB.

While I know that networking is not my forte, I do know how to read the
packet logs,
and I was lead to believe that someone is either running some badly
implemented
or configured software or that something harmful was actually originating
from
within the subnet.

From what I can tell, many of these denied packets are on ports 67 and 68,
which
according to my /etc/services is bootp. Is there a reason why someone would
run
a bootp server on an @Home network? Additionally, I receive a number of
high
level port hits from many anonymous IP's. Do game servers such as Quake
browse
around through subnets looking for replies? Because this seems to be the
activity
I am seeing. I do not see any typical ports for BO or other Windows based
subversions.
Many of the IP's floating in my logs are not in the @Home subnet which I
belong to.
I also see alot of local network IP's like 192.168.x.x trying to hit the
firewall as well.

Could this be a badly configured system somewhere else on my subnet, or is
it
possible that something more nefarious is going on. I can probably put up a
sample
of some of the log entries as well.

Thanks for


Current thread: