Re: Purpose of spoofed packets ???

[Fred Hollis <fred () web2objects com>]

Interesting... we had exactly the same an hour ago. That IP was 
definitely nullrouted for >1 week...

Matthew Huff:
> We recently got an abuse report of an IP address in our net range. However, that IP address isn't in use in our networks and 
> the covering network is null routed, so no return traffic is possible. We have external BGP monitoring, so unless something very 
> tricky is going on, we don't have part of our prefix hijacked.
>
> I assume the source address was spoofed, but this leads to my question. Since the person that submitted the report didn't mention a 
> high packet rate (it was on ssh port 22), it doesn't look like some sort of SYN attack, but any OS fingerprinting or doorknob twisting 
> wouldn't be useful from the attacker if the traffic doesn't return to them, so what gives?
>
> BTW, we are in the ARIN region, the report came out of the RIPE region.
>
>
> ----
> Matthew Huff             | 1 Manhattanville Rd
> Director of Operations   | Purchase, NY 10577
> OTA Management LLC       | Phone: 914-460-4039
> aim: matthewbhuff        | Fax:   914-694-5669