Re: IPIP (IP Protocol 94) Probe?

Article View: comp.security.firewalls

Article #76

Back to comp.security.firewalls Previous Next

#76

From: Christian Altenbach
Date: Wed, 11 Apr 2001 01:22

20 lines
1861 bytes

"Lawrence Baldwin" <baldwinl@mynetwatchman.com> wrote in message
news:MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net...
> [This followup was posted to comp.security.firewalls and a copy was sent
to the cited author.]
>
> Here was a pretty bizzare probe received today:
>
> http://www.mynetwatchman.com/kb/security/research/ipip.htm
>

Don't rule out the fact that it could be a very rare corrupted packet that
has a correct checksum just by accident.
Especially the second IP header makes absolutely no sense. Look at the
protocol (119), IP version, fragment offset, destIP=60.22.0.0, etc. A 1645
byte packet in a 131 byte packet! It looks just like garbage blindly
analyzed as IP header.

    Cheers
    C.

Technical Details

Message-ID: <9b0biq$srk$1@persian.noc.ucla.edu>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!canoe.uoregon.edu!newsfeed.news.ucla.edu!not-for-mail

References: <MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,36dd554aa7cf6f1b
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,36dd554aa7cf6f1b
X-Google-Attributes: gid10090f,public
X-Google-ArrivalTime: 2001-04-10 18:26:04 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!canoe.uoregon.edu!newsfeed.news.ucla.edu!not-for-mail
From: "Christian Altenbach" <caltenba@ucla.edu.invalid>
Newsgroups: comp.security.firewalls,bellsouth.net.security
Subject: Re: IPIP (IP Protocol 94) Probe?
Date: Tue, 10 Apr 2001 18:22:29 -0700
Organization: University of California, Los Angeles
Lines: 24
Message-ID: <9b0biq$srk$1@persian.noc.ucla.edu>
References: <MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net>
NNTP-Posting-Host: 149.142.139.170
X-Trace: persian.noc.ucla.edu 986952090 29556 149.142.139.170 (11 Apr 2001 01:21:30 GMT)
X-Complaints-To: abuse@ucla.edu
NNTP-Posting-Date: Wed, 11 Apr 2001 01:21:30 +0000 (UTC)
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200

Reply to Parent Message