🚀 go-pugleaf

l.cranswick@dl.ac.uk (Lachlan Cranswick) writes:



>(There was a previous security article about non-resolving IP addresses.
>This may or may not be related?).

<snip>

>For this event:
>The only thing in the TCPDUMP logs not easily explanable is a 
>lot of activity with an IP address of 151.104.78.243 that is
>not pingable and dies on a tracetroute in the 
>"bbnplanet.net" domain.  Activity from this IP ceases but

With non resolving IP addresses remember that 

whois -h whois.arin.net 151.104.78 

(in this case) is your friend and will either tell you who owns the domain or
refer you to the nic that will tell you that (and give contact people ...).
You of course need to drop the third octet to resolve a class B address although
in this case either resolve to Chipcom (which used to be a networking company).


>another replaces it for a few minutes: 151.99.133.130
>which is also not pingable and dies on a traceroute
>near "interbusiness.it" domain.

	Yep, whois says this is 

InterBusiness - Telecom Italia (NET-INTERBUSINESS)
   Via Paolo Di Dono, 44
   Roma, I-00143
   Italy

   Netname: INTERBUSINESS
   Netnumber: 151.99.0.0                                              

>Is this enough information to explain things?  Just
>in case, examples of the TCPDUMP (v3.4a5) and the traceroute
>are given below.  Nothing seems to be showing up in
>the UNIX SYSLOG and Deception Toolkit shows no probes
>on other ports.

>Lachlan.

>PS: Brings up another query - is there a tool that could do a TCPDUMP
>and also tell what files are being transferred as part of the status
>line with respect to http?

	Yep (if your network connection is slow enough or it is said if you 
buy the commercial version) Network Flight Recorder can be configured to do 
this. The free version loses packets on a moderately loaded ethernet (although
the commercial version, which I haven't tried, is supposed to survive around %70
loading on a FDDI link). NFR can be found at www.nfr.com. Since it is poking
around in the data portion of the packets you may have legal and certainly have
privacy issues in using it in this way. If you are interested in other intrusion
detection tools, there is  Argus from CMU (ftp.sei.cmu.edu/pub/argus) and
Shadow from SANS (http://www.nswc.navy.mil/ISSEC/CID) are the three free ones I
know of. There are a number of commercial versions as well (Ballista, the ISS
security scanner whatever its correct name is, and undoubtably others).

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada