Re: IPIP (IP Protocol 94) Probe?

Article View: comp.security.firewalls

Article #73

Back to comp.security.firewalls Previous Next

#73

From: Hal Burgiss
Date: Tue, 10 Apr 2001 23:25

29 lines
2163 bytes

On Tue, 10 Apr 2001 19:14:14 -0400, Lawrence Baldwin
<baldwinl@mynetwatchman.com> wrote:
>
>Here was a pretty bizzare probe received today:
>
>http://www.mynetwatchman.com/kb/security/research/ipip.htm
>

Ineteresting. I was just wondering how much stuff does get under the
radar screen. I just noticed some funny stuff, and if anyone out there
is really familiar with Linux tcp handling, this is what has me curious:

    3093 invalid SYN cookies received
    496 resets received for embryonic SYN_RECV sockets
    19102 packets pruned from receive queue because of socket buffer overrun
    12659 packets dropped from out-of-order queue because of socket buffer overrun

This is netstat output. This is probably just 'normal' errors, but there
never has ever been any of this logged AFAIK, so I just have to wonder
... This is over a fairly long period BTW, out of 12939486 total packets
received. Total greek to me.

-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
 Spamtrap: uce@ftc.gov and report@fraud.org
--

Technical Details

Message-ID: <slrn9d75jf.qu3.hal@localhost.localdomain>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!cyclone-sjo1.usenetserver.com!news-out-sjo.usenetserver.com!news3.bellglobal.com!sunqbc.risq.qc.ca!falcon.america.net!newsfeed.atl!news3.mia.POSTED!localhost!hal

References: <MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,36dd554aa7cf6f1b
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,36dd554aa7cf6f1b
X-Google-Attributes: gid10090f,public
X-Google-ArrivalTime: 2001-04-10 16:28:06 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!cyclone-sjo1.usenetserver.com!news-out-sjo.usenetserver.com!news3.bellglobal.com!sunqbc.risq.qc.ca!falcon.america.net!newsfeed.atl!news3.mia.POSTED!localhost!hal
From: hal@burgiss.net (Hal Burgiss)
Newsgroups: comp.security.firewalls,bellsouth.net.security
Subject: Re: IPIP (IP Protocol 94) Probe?
References: <MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net>
Reply-To: Hal Burgiss <hal@foobox.net>
Message-ID: <slrn9d75jf.qu3.hal@localhost.localdomain>
User-Agent: slrn/0.9.6.4 (Linux)
X-Original-NNTP-Posting-Host: 127.0.0.1
X-Original-Trace: 10 Apr 2001 19:25:35 -0400, 127.0.0.1
Lines: 29
Date: 10 Apr 2001 19:25:35 -0400
NNTP-Posting-Host: 216.78.197.8
X-Trace: news3.mia 986945140 216.78.197.8 (Tue, 10 Apr 2001 19:25:40 EDT)
NNTP-Posting-Date: Tue, 10 Apr 2001 19:25:40 EDT

Reply to Parent Message