Re: Strange attack question - seems udp

["Dick St.Peters" <stpeters () NetHeaven com>]

This probably wasn't an intentional "attack", it was probably just
someone using NFS.  The posted tcpdump output looks *exactly* like
part of an NFS read by 70.84.247.164 of a file mounted from
86.104.102.16.

Here's part of a tcpdump output on a Linux router for an NFS copy when
198.69.28.162 has a filesystem mounted from 208.20.133.4:

15:05:31.807546 IP (tos 0x0, ttl  63, id 6093, offset 11840, flags [+], 
length: 1500) 208.20.133.4 > 198.69.28.162: udp
15:05:31.807549 IP (tos 0x0, ttl  63, id 6093, offset 13320, flags [+], 
length: 1500) 208.20.133.4 > 198.69.28.162: udp
15:05:31.807554 IP (tos 0x0, ttl  63, id 6093, offset 14800, flags [+], 
length: 1500) 208.20.133.4 > 198.69.28.162: udp
15:05:31.807558 IP (tos 0x0, ttl  63, id 6093, offset 16280, flags [+], 
length: 1500) 208.20.133.4 > 198.69.28.162: udp
15:05:31.807561 IP (tos 0x0, ttl  63, id 6093, offset 17760, flags [+], 
length: 1500) 208.20.133.4 > 198.69.28.162: udp
15:05:31.807567 IP (tos 0x0, ttl  63, id 6093, offset 19240, flags [+], 
length: 1500) 208.20.133.4 > 198.69.28.162: udp

I don't have a Cisco 3750, but I do have a 3640, and trying the above
copy through my 3640 would choke it.

Modern NFS does 32KB writes by default, and these result in rapid fire
trains of 23 udp fragments sent as fast as the kernel can spew them
out.  Ciscos don't seem to be able to handle this.  (It will also
choke some RealTek-based NICs.)

Older NFS uses 8KB writes, meaning trains of 6 fragments.  These too
will sometimes choke Ciscos and certain RealTek-based NICs.

--
Dick St.Peters, stpeters () NetHeaven com 
Gatekeeper, NetHeaven, Saratoga Springs, NY

-----Original Message-----
From: Mihai Tanasescu [mailto:mihai () duras ro] 
Sent: Thursday, October 13, 2005 1:09 PM
To: incidents () securityfocus com
Subject: Strange attack question - seems udp

Hello,

I've been getting things like these recently:

21:00:52.941148 IP (tos 0x0, ttl 127, id 28639, offset 11840, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp
21:00:52.941271 IP (tos 0x0, ttl 127, id 28639, offset 13320, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp
21:00:52.941394 IP (tos 0x0, ttl 127, id 28639, offset 14800, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp
21:00:52.941517 IP (tos 0x0, ttl 127, id 28639, offset 16280, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp 21:00:52.941640 IP (tos
0x0, ttl 127, id 28639, offset 17760, flags [+],
length: 1500) 86.104.102.16 > 70.84.247.164: udp

I have 24 subnets inside a Cisco 3750.

After receiving many packets like these on 3-4 interfaces, Cisco starts
loosing packets and acts abnormal.

I have gathered the output show above from a Linux machine with tcpdump 
which acts as a border router.