Well, you're also assuming that the packets came from the IP addresses that they SAY they came from. It's possible that this was covert channel communications from one machine. Did you by any chance grab the actual contents of the pings? Also, why do you assume that other computers on your ISP's network may have been affected, and it if wasn't directed at your gateway, what kind of system WAS it directed at? > -----Original Message----- > From: securitynoticeat_private > [mailto:securitynoticeat_private] > Sent: Sunday, December 22, 2002 11:31 PM > To: incidentsat_private > Subject: strange traffic > > > Tonight at 6:04pm est, a bunch of ping packets hit my gateway from a > variety of sources in two . I am assuming the following: > > + this was not directed at my gateway specifically, but I am assuming > + that > other computers on my ISP's network may have also been affected > + this is not a DoS attempt, too few packets > + because it was from sources on a bunch of different networks, the ip > addresses here I'm assuming are compromised IP addresses > > My question(s) for the group here is, what was the purpose > behind this > traffic? It doesn't appear to be just reconnaisance > gathering (this would > be overkill). Your insights would be appreciated... > > Thanks! > > Michael Webb > > > note: the logs have been modified changing the hostname to > 'myhost' and > the target ip to 'www.xxx.yyy.zzz'. > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2752 F=0x0000 > T=55 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6054 F=0x0000 T=56 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27604 F=0x0000 > T=54 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64177 > F=0x0000 T=53 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=34747 > F=0x0000 T=47 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=15194 > F=0x0000 T=57 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62383 F=0x0000 T=47 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27709 F=0x0000 T=56 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19912 > F=0x0000 T=51 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19198 F=0x0000 > T=55 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=36239 > F=0x0000 T=50 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62363 F=0x0000 > T=46 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=53914 F=0x0000 T=50 (#1) > Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65109 F=0x0000 > T=57 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3076 F=0x0000 > T=55 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6396 F=0x0000 T=56 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28911 F=0x0000 > T=54 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65317 > F=0x0000 T=53 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=16636 > F=0x0000 T=57 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35371 > F=0x0000 T=47 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28658 F=0x0000 T=56 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63011 F=0x0000 T=47 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19541 F=0x0000 > T=55 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=37238 > F=0x0000 T=50 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63227 F=0x0000 > T=46 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=25147 > F=0x0000 T=51 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=54801 F=0x0000 T=50 (#1) > Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=961 F=0x0000 T=57 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3359 F=0x0000 > T=55 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6739 F=0x0000 T=56 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=30150 F=0x0000 > T=54 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=789 F=0x0000 T=53 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35953 > F=0x0000 T=47 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63666 F=0x0000 T=47 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=18156 > F=0x0000 T=57 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=29583 F=0x0000 T=56 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19919 F=0x0000 > T=55 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64162 F=0x0000 > T=46 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=38267 > F=0x0000 T=50 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=26924 > F=0x0000 T=51 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=55687 F=0x0000 T=50 (#1) > Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 > 63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2304 F=0x0000 T=57 (#1) > > > -------------------------------------------------------------- > -------------- > This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: http://aris.securityfocus.com > ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Fri Dec 27 2002 - 09:52:34 PST