Re: Packet from port 80 with spoofed microsoft.com ip

From: Michael Rowe (mroweat_private)
Date: Thu Jan 30 2003 - 03:22:05 PST

Next message: David Hickman: "Re: Firewall logging port 6346"

Previous message: Michael Rowe: "Re: Packet from port 80 with spoofed microsoft.com ip"
In reply to: NESTING, DAVID M (SBCSI): "RE: Packet from port 80 with spoofed microsoft.com ip"
Next in thread: Keith Owens: "Re: Packet from port 80 with spoofed microsoft.com ip"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On 03/01/29 14:11 -0600, NESTING, DAVID M (SBCSI) wrote:
> Are you SURE nothing on your end would have attempted to initiate a
> connection to this site?  When you say your Windows computers weren't
> "active", did you mean they were physically powered off, or just idle?

Yeah, turned off.

On balance, it seems like the mostly likely explaination is my IP
being used in a spoofed SYN attack. A distant second: the MS web
server sending a wildly delayed ack to a legitimate connection.

Thanks for the responses!

-- 
Michael Rowe <mroweat_private>

IM  - mroweat_private                Prof - ACM, IEEE, Computer Soc.
Web - http://www.mojain.com/          Vice - Barley malt, brewed or
Key - http://mojain.com/keys/mrowe.asc       distilled (hold the ice)

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: David Hickman: "Re: Firewall logging port 6346"
Previous message: Michael Rowe: "Re: Packet from port 80 with spoofed microsoft.com ip"
In reply to: NESTING, DAVID M (SBCSI): "RE: Packet from port 80 with spoofed microsoft.com ip"
Next in thread: Keith Owens: "Re: Packet from port 80 with spoofed microsoft.com ip"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jan 30 2003 - 10:55:53 PST