Mike Tibor wrote: > > On Thu, 19 Apr 2001, Crist Clark wrote: > > > The last router before the machine logging these would not happen to > > be a Cisco? Would not happen to have directed broadcasts enabled? > > Unfortnately I don't have any control over our routers, and don't know how > they're configured. Test it. From an external location, try sending traffic to the broadcast address of this network you are seeing the traffic on. > > This looks like someone trying to UDP-chargen "smurf" 194.72.6.103. Can > > you traceroute to that address and see if the distance jives with your > > observation of about 11 hops (which you consider close?). > > That's about what I thought. I fired up tcpdump to see which MAC address > was generating the traffic. Although the udp flooding had already > stopped, I did see some new traffic with a destination address of > 255.255.255.255, and a destination port of 21/tcp (one of the recent worms > maybe?). Tcpdump showed the MAC address for that stuff as being the > router's interface on my network. Your broadcast address(es) on this network would not happen to be ones that might commonly be seen as host addresses, AAA.BBB.CCC.127, AAA.BBB.CCC.31, etc. Similarly, are you seeing patterns like, <remote IP> -> 255.255.255.255 <remote IP> -> AAA.BBB.CCC.1 <remote IP> -> AAA.BBB.CCC.2 <remote IP> -> AAA.BBB.CCC.3 . . . <remote IP> -> AAA.BBB.CCC.253 <remote IP> -> AAA.BBB.CCC.254 <remote IP> -> 255.255.255.255 -- Crist J. Clark Network Security Engineer crist.clarkat_private Globalstar, L.P. (408) 933-4387 FAX: (408) 933-4926 The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact postmasterat_private
This archive was generated by hypermail 2b30 : Fri Apr 20 2001 - 10:34:06 PDT