Re: Bad Loopback Traffic

[bclark () bwkip com]

My new comments below:

> The best summary of an explanation I have seen is attached below (From
> Dan of the Incidents list).
>
> Regards,
> Frank
>
> ---8<---
>
> -----Forwarded Message-----=20
> From: Dan Hanson <dhanson () securityfocus com>
> To: incidents () securityfocus com
> Subject: Administrivia: Are you seeing portscans from source 127.0.0.1
> source port 80?
> Date: Tue, 28 Oct 2003 08:59:56 -0700
>
> I am posting this in the hopes of dulling the 5-6 messages I get every
> day
> that are reporting port scans to their network all of which have a
> source
> IP of 127.0.0.1 and source port 80.
>
> It is likely Blaster (check your favourite AV site for a writeup, I
> won't
> summarize here).
>
> The reason that people are seeing this has to do with some very bad
> advice
> that was given early in the blaster outbreak. The advice basically was
> that to protect the Internet from the DoS attack that was to hit
> windowsupdate.com, all DNS servers should return 127.0.0.1 for queries
> to
> windowsupdate.com. Essentially these suggestions were suggesting that
> hosts should commit suicide to protect the Internet.
>
> The problem is that the DoS routine spoofs the source address, so when
> windowsupdate.com resolves to 127.0.0.1 the following happens.
>
> Infected host picks address as source address and sends Syn packet to
> 127.0.0.1 port 80. (Sends it to itself) (This never makes it on the
> wire,
> you will not see this part)
>
> TCP/IP stack receives packet, responds with reset (if there is nothing
> listening on that port), sending the reset to the host with the spoofed
> source address (this is what people are seeing and mistaking for
> portscans)
>
> Result: It looks like a host is port scanning ephemeral posts using
> packets with source address:port of 127.0.0.1:80
>
> Solution: track back the packets by MAC address to find hte infected
> machine. Turn of NS resolution of windowsupdate.com to 127.0.0.1.
>
> Hope that helps
>
> D

Not sure that is it because the destination is port 80 not local host, but
I do see the packet have a FIN flag. Most of the time the destinations are
within the Class A that my class C belong too.

Brian




-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users