RE: TCP Src 5635: what is it?

["Curt Purdy" <purdy () tecman com>]

IMO, this looks like an hping2 scan.  See
http://project.honeynet.org/scans/arch/scan1.txt for a sample honeynet scan
that is just the opposite (dest 0 - src high port).  But as they explain,
the default hping2 is actually (scr 0 - dest high port) as in your case.

Curt Purdy
Information Systems Engineer
DP Solutions

-----Original Message-----
From: rlt () subdimension com [mailto:rlt () subdimension com]
Sent: Tuesday, July 10, 2001 10:11 AM
To: incidents () securityfocus com
Subject: TCP Src 5635: what is it?


Just a little help needed here.  I've been seeing a lot of traffic with
a source port of 5635 and a destination port of 0.  Searching on google
yields no significant results.  There were two forums that asked the
same question and haven't yet gotten an answer.  I asked the posters for
more information and if there problems had been resolved but I haven't
gotten a response yet.  So, any help and or insight would be much
appreciated.

Here's an excerpt from my logs:

Time,Source Addr,Source Port,Dest Addr,Dest Port,TCP/UDP,TCP Flags
,,,,,,
6/28/01 15:41,208.33.170.61
(cvxp061.intrstar.net),5635,Host.In.Our.DMZ,0,TCP,
6/28/01 15:41,208.33.170.61
(cvxp061.intrstar.net),5635,Host.In.Our.DMZ,0,TCP,fin rst psh
6/28/01 16:55,63.254.34.74 (A010-
0074.FRDK.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn psh
6/28/01 17:50,208.33.170.154
(cvxp154.intrstar.net),5635,Host.In.Our.DMZ,0,TCP,rst
6/29/01 0:04,63.252.82.9 (A010-
0009.FTVL.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst psh ack
urg
6/29/01 0:04,63.252.82.9 (A010-
0009.FTVL.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst
6/29/01 0:04,63.252.82.9 (A010-
0009.FTVL.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,rst urg
6/29/01 7:26,63.255.89.15 (A010-
0015.HIPT.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:26,63.255.89.15 (A010-
0015.HIPT.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:26,63.255.89.15 (A010-
0015.HIPT.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:26,63.255.89.15 (A010-
0015.HIPT.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:26,63.255.89.15 (A010-
0015.HIPT.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:27,63.255.89.15 (A010-
0015.HIPT.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:28,63.255.89.15 (A010-
0015.HIPT.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,psh urg
6/29/01 7:34,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:34,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:34,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:34,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg
6/29/01 7:35,209.156.206.217 (A020-
0979.GNBO.splitrock.net),5635,Host.In.Our.DMZ,0,TCP,fin syn rst urg

The TCP flags are varied.  I know it's not indicated here but I didn't
want to send the entire list of attempts.

There server that these IP's are destined for happens to be a HTTPS
server.  And these IP's have also established full connections with the
server.  So I'm not sure if this is an attack or some wacky software mis-
configuration.

Again, any help and or insight would be appreciated.

Thanks in advance.

-Rick

--------------------------------------
FREE ANONYMOUS EMAIL!  Sign up now.
http://www.subdimension.com/freemail


----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see:

http://aris.securityfocus.com




----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com