Tonight at 6:04pm est, a bunch of ping packets hit my gateway from a variety of sources in two . I am assuming the following: + this was not directed at my gateway specifically, but I am assuming that other computers on my ISP's network may have also been affected + this is not a DoS attempt, too few packets + because it was from sources on a bunch of different networks, the ip addresses here I'm assuming are compromised IP addresses My question(s) for the group here is, what was the purpose behind this traffic? It doesn't appear to be just reconnaisance gathering (this would be overkill). Your insights would be appreciated... Thanks! Michael Webb note: the logs have been modified changing the hostname to 'myhost' and the target ip to 'www.xxx.yyy.zzz'. Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2752 F=0x0000 T=55 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6054 F=0x0000 T=56 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27604 F=0x0000 T=54 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64177 F=0x0000 T=53 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=34747 F=0x0000 T=47 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=15194 F=0x0000 T=57 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62383 F=0x0000 T=47 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27709 F=0x0000 T=56 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19912 F=0x0000 T=51 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19198 F=0x0000 T=55 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=36239 F=0x0000 T=50 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62363 F=0x0000 T=46 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=53914 F=0x0000 T=50 (#1) Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65109 F=0x0000 T=57 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3076 F=0x0000 T=55 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6396 F=0x0000 T=56 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28911 F=0x0000 T=54 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65317 F=0x0000 T=53 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=16636 F=0x0000 T=57 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35371 F=0x0000 T=47 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28658 F=0x0000 T=56 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63011 F=0x0000 T=47 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19541 F=0x0000 T=55 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=37238 F=0x0000 T=50 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63227 F=0x0000 T=46 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=25147 F=0x0000 T=51 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=54801 F=0x0000 T=50 (#1) Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=961 F=0x0000 T=57 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3359 F=0x0000 T=55 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6739 F=0x0000 T=56 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=30150 F=0x0000 T=54 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=789 F=0x0000 T=53 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35953 F=0x0000 T=47 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63666 F=0x0000 T=47 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=18156 F=0x0000 T=57 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=29583 F=0x0000 T=56 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19919 F=0x0000 T=55 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64162 F=0x0000 T=46 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=38267 F=0x0000 T=50 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=26924 F=0x0000 T=51 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=55687 F=0x0000 T=50 (#1) Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2304 F=0x0000 T=57 (#1) ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Dec 24 2002 - 01:26:38 PST