🚀 go-pugleaf

On Tue, 10 Apr 2001 19:14:14 -0400, Lawrence Baldwin
<baldwinl@mynetwatchman.com> wrote:
>
>Here was a pretty bizzare probe received today:
>
>http://www.mynetwatchman.com/kb/security/research/ipip.htm
>

Ineteresting. I was just wondering how much stuff does get under the
radar screen. I just noticed some funny stuff, and if anyone out there
is really familiar with Linux tcp handling, this is what has me curious:

    3093 invalid SYN cookies received
    496 resets received for embryonic SYN_RECV sockets
    19102 packets pruned from receive queue because of socket buffer overrun
    12659 packets dropped from out-of-order queue because of socket buffer overrun

This is netstat output. This is probably just 'normal' errors, but there
never has ever been any of this logged AFAIK, so I just have to wonder
... This is over a fairly long period BTW, out of 12939486 total packets
received. Total greek to me.

-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
 Spamtrap: uce@ftc.gov and report@fraud.org
--

[This followup was posted to comp.security.firewalls and a copy was sent to the cited author.]

FYI,

I also scanned the entire ~100,000 records in the myNetWatchman database...the ONLY protocolIDs in 
there are 6 (TCP), 17 (UDP), and 1 (ICMP).

Since MNW is fed by *many* different firewalls (e.g. SonicWall, IPChains, etc...) I can only assume 
that they're not logging these kind of events either.  (Unless Chad coded the myNetWatchman 
PerlAgent to discard these???)

lb.
In article <slrn9d75jf.qu3.hal@localhost.localdomain>, hal@burgiss.net says...
> On Tue, 10 Apr 2001 19:14:14 -0400, Lawrence Baldwin
> <baldwinl@mynetwatchman.com> wrote:
> >
> >Here was a pretty bizzare probe received today:
> >
> >http://www.mynetwatchman.com/kb/security/research/ipip.htm
> >
> 
> Ineteresting. I was just wondering how much stuff does get under the
> radar screen. I just noticed some funny stuff, and if anyone out there
> is really familiar with Linux tcp handling, this is what has me curious:
> 


-- 
Lawrence Baldwin
Baseline your FastAccess Connection: http://www.mynetwatchman.com/perfwatch/beta.htm
Automatic Port Scan Reporting: http://www.mynetwatchman.com/vision.htm

On Tue, 10 Apr 2001 19:37:01 -0400, Lawrence Baldwin
<baldwinl@mynetwatchman.com> wrote:
>
>Since MNW is fed by *many* different firewalls (e.g. SonicWall,
>IPChains, etc...) I can only assume that they're not logging these kind
>of events either.  (Unless Chad coded the myNetWatchman PerlAgent to
>discard these???)

Chad is only reporting the same -- 1,6,17. AFAIK, Linux ipchains (2.2
kernel) only reports these too. 2.4 kernel does much more I believe.

Found this link on IPIP:

http://www.linuxports.com/howto/networking/x1262.htm

A Linux site, but nice explanation.

-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
 Spamtrap: uce@ftc.gov and report@fraud.org
--

"Lawrence Baldwin" <baldwinl@mynetwatchman.com> wrote in message
news:MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net...
> [This followup was posted to comp.security.firewalls and a copy was sent
to the cited author.]
>
> Here was a pretty bizzare probe received today:
>
> http://www.mynetwatchman.com/kb/security/research/ipip.htm
>

Don't rule out the fact that it could be a very rare corrupted packet that
has a correct checksum just by accident.
Especially the second IP header makes absolutely no sense. Look at the
protocol (119), IP version, fragment offset, destIP=60.22.0.0, etc. A 1645
byte packet in a 131 byte packet! It looks just like garbage blindly
analyzed as IP header.

    Cheers
    C.

ipchains packets will be forwarded, but others that don't explicitly use a
protocol number would be a problem.  Although I suppose it wouldn't be too
hard to do a getprotobyname(), :)


"Lawrence Baldwin" <baldwinl@mynetwatchman.com> wrote in message
news:MPG.153d631b483152ec9896a2@news2.mia.bellsouth.net...
> [This followup was posted to comp.security.firewalls and a copy was sent
to the cited author.]
>
> FYI,
>
> I also scanned the entire ~100,000 records in the myNetWatchman
database...the ONLY protocolIDs in
> there are 6 (TCP), 17 (UDP), and 1 (ICMP).
>
> Since MNW is fed by *many* different firewalls (e.g. SonicWall, IPChains,
etc...) I can only assume
> that they're not logging these kind of events either.  (Unless Chad coded
the myNetWatchman
> PerlAgent to discard these???)
>
> lb.
> In article <slrn9d75jf.qu3.hal@localhost.localdomain>, hal@burgiss.net
says...
> > On Tue, 10 Apr 2001 19:14:14 -0400, Lawrence Baldwin
> > <baldwinl@mynetwatchman.com> wrote:
> > >
> > >Here was a pretty bizzare probe received today:
> > >
> > >http://www.mynetwatchman.com/kb/security/research/ipip.htm
> > >
> >
> > Ineteresting. I was just wondering how much stuff does get under the
> > radar screen. I just noticed some funny stuff, and if anyone out there
> > is really familiar with Linux tcp handling, this is what has me curious:
> >
>
>
> --
> Lawrence Baldwin
> Baseline your FastAccess Connection:
http://www.mynetwatchman.com/perfwatch/beta.htm
> Automatic Port Scan Reporting: http://www.mynetwatchman.com/vision.htm

your dynamic ip address?
remember the port 13121 i reported?
checked my logs

started 2 mins after SW got a new ip addresws (one of the PPoE ones I have)

so, someone has their own private tunneling, OR are trying to trash your
system
(DDOS attack?)


"Lawrence Baldwin" <baldwinl@mynetwatchman.com> wrote in message
news:MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net...
> [This followup was posted to comp.security.firewalls and a copy was sent
to the cited author.]
>
> Here was a pretty bizzare probe received today:
>
> http://www.mynetwatchman.com/kb/security/research/ipip.htm
>
> --
> Lawrence Baldwin
> myNetWatchman.com
> Automatic Port Scan Reporting: http://www.mynetwatchman.com/vision.htm