Thread View: comp.security.misc
5 messages
5 total messages
Started by Lachlan Cranswick
Thu, 12 Nov 1998 00:00
Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non resolving...
Author: Lachlan Cranswick
Date: Thu, 12 Nov 1998 00:00
Date: Thu, 12 Nov 1998 00:00
173 lines
11330 bytes
11330 bytes
(There was a previous security article about non-resolving IP addresses.
This may or may not be related?).
Are there tools or methods available for Web-serving/Apache/UNIX that
can help distinguishing between network misconfigs/slowness/nuances
vs attempted Denial of Services Attacks on the Web-server port?
I have some very wierd behaviour on the Apache 1.3.3 webserver
for SGI O2 running IRIX 6.3 - with DNS resolution enabled inside
the webserver.
An occassional occurance for me is to see the Apache 1.3.3
server-status screen gives "Client" names of ????
"Vhost" of ????? and "Request" of "reading... with very "bursty"
start/stop speeds. (1/2th to 1/20th of normal average throughput
from web-server to a local client PC when this is happening).
Nothing obvious in the default apache logs.
This occured today but was ready for it with tcpdump.
For this event:
The only thing in the TCPDUMP logs not easily explanable is a
lot of activity with an IP address of 151.104.78.243 that is
not pingable and dies on a tracetroute in the
"bbnplanet.net" domain. Activity from this IP ceases but
another replaces it for a few minutes: 151.99.133.130
which is also not pingable and dies on a traceroute
near "interbusiness.it" domain.
Is this enough information to explain things? Just
in case, examples of the TCPDUMP (v3.4a5) and the traceroute
are given below. Nothing seems to be showing up in
the UNIX SYSLOG and Deception Toolkit shows no probes
on other ports.
Lachlan.
PS: Brings up another query - is there a tool that could do a TCPDUMP
and also tell what files are being transferred as part of the status
line with respect to http?
TCPDUMP of 151.104.78.243 hitting the http port:
************************************************************
16:43:20.314048 sv1.http > 151.104.78.243.4873: FP 5841:6006(165) ack 160 win 61320 (DF)
16:43:20.690926 151.104.78.243.4873 > sv1.http: . ack 6007 win 8595 (DF)
16:43:20.824125 151.104.78.243.4873 > sv1.http: F 160:160(0) ack 6007 win 8595 (DF)
16:43:20.824248 sv1.http > 151.104.78.243.4873: . ack 161 win 61320 (DF)
16:43:21.723077 151.104.78.243.4880 > sv1.http: S 19853440:19853440(0) win 8192 <mss 1460> (DF)
16:43:21.723318 sv1.http > 151.104.78.243.4880: S 1192966000:1192966000(0) ack 19853441 win 61320 <mss 1460> (DF)
16:43:22.111992 151.104.78.243.4880 > sv1.http: . ack 1 win 8760 (DF)
16:43:22.352313 151.104.78.243.4880 > sv1.http: P 1:156(155) ack 1 win 8760 (DF)
16:43:22.370785 sv1.http > 151.104.78.243.4880: . 1:1461(1460) ack 156 win 61320 (DF)
16:43:22.370867 sv1.http > 151.104.78.243.4880: . 1461:2921(1460) ack 156 win 61320 (DF)
16:43:25.274577 sv1.http > 151.104.78.243.4880: . 1:1461(1460) ack 156 win 61320 (DF)
16:43:26.123811 151.104.78.243.4880 > sv1.http: . ack 2921 win 8760 (DF)
16:43:26.123988 sv1.http > 151.104.78.243.4880: . 2921:4381(1460) ack 156 win 61320 (DF)
16:43:26.124062 sv1.http > 151.104.78.243.4880: FP 4381:5794(1413) ack 156 win 61320 (DF)
16:43:26.619182 151.104.78.243.4880 > sv1.http: . ack 5795 win 8760 (DF)
16:43:26.672060 151.104.78.243.4880 > sv1.http: F 156:156(0) ack 5795 win 8760 (DF)
16:43:26.672177 sv1.http > 151.104.78.243.4880: . ack 157 win 61320 (DF)
16:43:26.845438 151.104.78.243.4883 > sv1.http: S 19858562:19858562(0) win 8192 <mss 1460> (DF)
16:43:26.845623 sv1.http > 151.104.78.243.4883: S 1193798000:1193798000(0) ack 19858563 win 61320 <mss 1460> (DF)
16:43:27.266242 151.104.78.243.4883 > sv1.http: . ack 1 win 8760 (DF)
16:43:27.275817 151.104.78.243.4883 > sv1.http: P 1:169(168) ack 1 win 8760 (DF)
16:43:27.278348 sv1.http > 151.104.78.243.4883: . 1:1461(1460) ack 169 win 61320 (DF)
16:43:27.278463 sv1.http > 151.104.78.243.4883: . 1461:2921(1460) ack 169 win 61320 (DF)
16:43:27.752481 151.104.78.243.4883 > sv1.http: . ack 2921 win 8760 (DF)
16:43:27.752633 sv1.http > 151.104.78.243.4883: FP 2921:3443(522) ack 169 win 61320 (DF)
16:43:28.185871 151.104.78.243.4883 > sv1.http: . ack 3444 win 8238 (DF)
16:43:28.465642 151.104.78.243.4883 > sv1.http: F 169:169(0) ack 3444 win 8238 (DF)
16:43:28.465757 sv1.http > 151.104.78.243.4883: . ack 170 win 61320 (DF)
16:43:34.189921 151.104.78.243.4892 > sv1.http: S 19865658:19865658(0) win 8192 <mss 1460> (DF)
16:43:34.190192 sv1.http > 151.104.78.243.4892: S 1194758000:1194758000(0) ack 19865659 win 61320 <mss 1460> (DF)
16:43:39.774545 sv1.http > 151.104.78.243.4892: S 1194758000:1194758000(0) ack 19865659 win 61320 <mss 1460> (DF)
16:43:43.636191 151.104.78.243.4892 > sv1.http: S 19865658:19865658(0) win 8192 <mss 1460> (DF)
16:43:43.636320 sv1.http > 151.104.78.243.4892: S 1194758000:1194758000(0) ack 19865659 win 61320 <mss 1460> (DF)
16:43:44.766979 151.104.78.243.4892 > sv1.http: . ack 1 win 8760 (DF)
TCPDUMP of 151.99.133.130 hitting the http port:
************************************************************
17:14:50.024543 151.99.133.130.57032 > sv1.http: S 141282566:141282566(0) win 8760 <mss 1460> (DF)
17:14:50.024989 sv1.http > 151.99.133.130.57032: S 1449414000:1449414000(0) ack 141282567 win 61320 <mss 1460> (DF)
17:14:53.178950 151.99.133.130.57032 > sv1.http: P 1:460(459) ack 1 win 8760 (DF)
17:14:53.187859 sv1.http > 151.99.133.130.57032: P 1:472(471) ack 460 win 61320 (DF)
17:14:53.215387 sv1.http > 151.99.133.130.57032: F 472:472(0) ack 460 win 61320 (DF)
17:14:53.561938 151.99.133.130.57032 > sv1.http: . ack 473 win 8760 (DF)
17:14:53.561998 151.99.133.130.57032 > sv1.http: F 460:460(0) ack 473 win 8760 (DF)
17:14:53.562292 sv1.http > 151.99.133.130.57032: . ack 461 win 61320 (DF)
17:14:54.151463 151.99.133.130.57096 > sv1.http: S 155778963:155778963(0) win 8760 <mss 1460> (DF)
17:14:54.151889 sv1.http > 151.99.133.130.57096: S 1449990000:1449990000(0) ack 155778964 win 61320 <mss 1460> (DF)
17:14:56.381969 151.99.133.130.57032 > sv1.http: F 460:460(0) ack 473 win 8760 (DF)
17:14:56.382146 sv1.http > 151.99.133.130.57032: . ack 461 win 61320 (DF)
17:14:59.774857 sv1.http > 151.99.133.130.57096: S 1449990000:1449990000(0) ack 155778964 win 61320 <mss 1460> (DF)
17:15:00.093672 151.99.133.130.57096 > sv1.http: . ack 1 win 8760 (DF)
17:15:00.110463 151.99.133.130.57096 > sv1.http: P 1:459(458) ack 1 win 8760 (DF)
17:15:00.185868 sv1.http > 151.99.133.130.57096: . 1:1461(1460) ack 459 win 61320 (DF)
17:15:00.185964 sv1.http > 151.99.133.130.57096: . 1461:2921(1460) ack 459 win 61320 (DF)
17:15:00.491748 151.99.133.130.57096 > sv1.http: . ack 1461 win 8760 (DF)
17:15:00.492089 sv1.http > 151.99.133.130.57096: . 2921:4381(1460) ack 459 win 61320 (DF)
17:15:00.492197 sv1.http > 151.99.133.130.57096: . 4381:5841(1460) ack 459 win 61320 (DF)
17:15:00.573683 151.99.133.130.57096 > sv1.http: . ack 2921 win 8760 (DF)
17:15:00.573900 sv1.http > 151.99.133.130.57096: . 5841:7301(1460) ack 459 win 61320 (DF)
17:15:00.853675 151.99.133.130.57096 > sv1.http: . ack 5841 win 8760 (DF)
17:15:00.854035 sv1.http > 151.99.133.130.57096: . 7301:8761(1460) ack 459 win 61320 (DF)
ATTEMPTED TRACEROUTE of 151.104.78.243
**************************************
/usr/etc/traceroute 151.104.78.243
traceroute to 151.104.78.243 (151.104.78.243), 30 hops max, 40 byte packets
1 alan3.dl.ac.uk (148.79.1.1) 2 ms (ttl=32!) 1 ms (ttl=32!) 1 ms (ttl=32!)
2 nnw-gw.dl.ac.uk (193.63.74.1) 2 ms (ttl=29!) 2 ms (ttl=29!) 2 ms (ttl=29!)
3 gw-mcc.netnw.net.uk (194.66.24.1) 5 ms (ttl=28!) 5 ms (ttl=28!) 5 ms (ttl=28!)
4 manchester-core.ja.net (146.97.253.133) 6 ms 10 ms 6 ms
5 external-gw.ja.net (146.97.253.57) 16 ms 16 ms 15 ms
6 tglobe-gw2.ja.net (193.63.94.80) 17 ms 17 ms 18 ms
7 ppt-gw.ja.net (193.62.157.10) 95 ms 97 ms 103 ms
8 gin-ppt-bb2.Teleglobe.net (207.45.215.165) 99 ms (ttl=247!) 96 ms 100 ms
9 gin-ppt-bb1.Teleglobe.net (207.45.215.2) 97 ms 107 ms 99 ms
10 gin-nyy-core1.Teleglobe.net (207.45.199.233) 116 ms 128 ms 124 ms
11 gin-nyy-bb1.Teleglobe.net (207.45.223.170) 113 ms 112 ms 113 ms
12 h3-0-0.nyc4-br1.bbnplanet.net (4.0.3.21) 120 ms 111 ms 115 ms
13 p3-0.nyc4-nbr3.bbnplanet.net (4.0.3.145) 118 ms 116 ms 115 ms
14 p1-3.cambridge1-nbr2.bbnplanet.net (4.0.2.169) 129 ms 127 ms *
15 p1-0-0.cambridge1-br2.bbnplanet.net (4.0.1.46) 120 ms 117 ms 123 ms
16 f0.cambridge1-mr5.bbnplanet.net (206.34.78.38) 127 ms 122 ms 125 ms
17 s4-5.worcester-cr1.bbnplanet.net (206.34.110.10) 128 ms
s3-2.worcester-cr1.bbnplanet.net (206.34.110.14) 137 ms
s2-5.worcester-cr1.bbnplanet.net (206.34.110.22) 171 ms
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
/usr/etc/traceroute 151.99.133.130
traceroute to 151.99.133.130 (151.99.133.130), 30 hops max, 40 byte packets
1 alan3.dl.ac.uk (148.79.1.1) 1 ms (ttl=32!) 1 ms (ttl=32!) 1 ms (ttl=32!)
2 nnw-gw.dl.ac.uk (193.63.74.1) 3 ms (ttl=29!) 2 ms (ttl=29!) 2 ms (ttl=29!)
3 gw-mcc.netnw.net.uk (194.66.24.1) 5 ms (ttl=28!) 4 ms (ttl=28!) 6 ms (ttl=28!)
4 manchester-core.ja.net (146.97.253.133) 8 ms 7 ms 9 ms
5 external-gw.ja.net (146.97.253.57) 17 ms 17 ms 15 ms
6 ten34-gw.ja.net (193.63.94.250) 18 ms 22 ms 17 ms
7 janet.UK.ten-34.net (193.203.228.9) 22 ms 19 ms 22 ms
8 london6.att-unisource.net (195.206.64.69) 18 ms 17 ms 18 ms
9 london5.att-unisource.net (195.206.64.49) 24 ms 22 ms 23 ms
10 amsterdam9.att-unisource.net (195.206.65.29) 30 ms 30 ms 36 ms
11 geneva5.att-unisource.net (195.206.65.242) 60 ms 44 ms 49 ms
12 195.206.66.182 (195.206.66.182) 172 ms 169 ms (ttl=245!) 194 ms (ttl=245!)
13 195.22.192.14 (195.22.192.14) 237 ms (ttl=245!) 173 ms (ttl=244!) *
14 r-rm9-seabone-6.interbusiness.it (151.99.49.181) 589 ms (ttl=244!) 364 ms (ttl=244!) 284 ms (ttl=244!)
15 r-rm5-fe3.interbusiness.it (151.99.5.209) 291 ms (ttl=243!) 274 ms (ttl=243!) 310 ms (ttl=243!)
16 r-rm4-fe1.interbusiness.it (151.99.5.147) 239 ms (ttl=242!) 432 ms (ttl=242!) 464 ms (ttl=242!)
17 151.99.8.70 (151.99.8.70) 365 ms (ttl=242!) 371 ms (ttl=242!) 416 ms (ttl=242!)
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
Lachlan M. D. Cranswick
Collaborative Computational Project No 14 (CCP14)
for Single Crystal and Powder Diffraction
Daresbury Laboratory, Warrington, WA4 4AD U.K
Tel: +44 (0)1925-603703 Fax: +44 (0)1925-603124 Room C14
E-mail: l.cranswick@dl.ac.uk
CCP14 Webpage (Under heavy construction):
http://www.ccp14.ac.uk
Re: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non reso...
Author: Bill Jones
Date: Wed, 11 Nov 1998 00:00
Date: Wed, 11 Nov 1998 00:00
44 lines
2494 bytes
2494 bytes
Lachlan Cranswick wrote:
> <snip>
> PS: Brings up another query - is there a tool that could do a TCPDUMP
> and also tell what files are being transferred as part of the status
> line with respect to http?
> <snip alot of reports not cleaned up...>
You guys are killing me :] try this -
#!/usr/bin/perl
$LIMIT = shift || 5000000;
$|=1;
open (STDIN,"/usr/sbin/tcpdump -lnx -s 1024 dst port 80 |");
while (<>) {
if (/^\S/) {
last unless $LIMIT--;
while ($packet=~/(GET|POST|WWW-Authenticate|Authorization).+/g) {
print "$client -> $host\t$&\n";
}
undef $client; undef $host; undef $packet;
($client,$host) = /(\d+\.\d+\.\d+\.\d+).+ > (\d+\.\d+\.\d+\.\d+)/
if /P \d+:\d+\((\d+)\)/ && $1 > 0;
}
next unless $client && $host;
s/\s+//;
s/([0-9a-f]{2})\s?/chr(hex($1))/eg;
tr/\x1F-\x7E\r\n//cd;
$packet .= $_;
}
Lincoln wrote the above, but it's more or less public domain.
Enjoy!
-Sneex- :]
________________________________________________________________________
Bill Jones | FCCJ Webmaster | x3089 | http://webmaster.fccj.org:81
------------------------------------------------------------------------
__ _ RedHat 5.1 Manhatten
/ /(_)_ __ _ ___ __ http://www.apache.org
/ / | | '_ \| | | \ \/ / http://www.redhat.com
/ /__| | | | | |_| |> < http://www.perl.com
\____/_|_| |_|\__,_/_/\_\ http://www.gimp.org
Re: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non resol...
Author: Peter Van Epp
Date: Thu, 12 Nov 1998 00:00
Date: Thu, 12 Nov 1998 00:00
65 lines
3458 bytes
3458 bytes
l.cranswick@dl.ac.uk (Lachlan Cranswick) writes: >(There was a previous security article about non-resolving IP addresses. >This may or may not be related?). <snip> >For this event: >The only thing in the TCPDUMP logs not easily explanable is a >lot of activity with an IP address of 151.104.78.243 that is >not pingable and dies on a tracetroute in the >"bbnplanet.net" domain. Activity from this IP ceases but With non resolving IP addresses remember that whois -h whois.arin.net 151.104.78 (in this case) is your friend and will either tell you who owns the domain or refer you to the nic that will tell you that (and give contact people ...). You of course need to drop the third octet to resolve a class B address although in this case either resolve to Chipcom (which used to be a networking company). >another replaces it for a few minutes: 151.99.133.130 >which is also not pingable and dies on a traceroute >near "interbusiness.it" domain. Yep, whois says this is InterBusiness - Telecom Italia (NET-INTERBUSINESS) Via Paolo Di Dono, 44 Roma, I-00143 Italy Netname: INTERBUSINESS Netnumber: 151.99.0.0 >Is this enough information to explain things? Just >in case, examples of the TCPDUMP (v3.4a5) and the traceroute >are given below. Nothing seems to be showing up in >the UNIX SYSLOG and Deception Toolkit shows no probes >on other ports. >Lachlan. >PS: Brings up another query - is there a tool that could do a TCPDUMP >and also tell what files are being transferred as part of the status >line with respect to http? Yep (if your network connection is slow enough or it is said if you buy the commercial version) Network Flight Recorder can be configured to do this. The free version loses packets on a moderately loaded ethernet (although the commercial version, which I haven't tried, is supposed to survive around %70 loading on a FDDI link). NFR can be found at www.nfr.com. Since it is poking around in the data portion of the packets you may have legal and certainly have privacy issues in using it in this way. If you are interested in other intrusion detection tools, there is Argus from CMU (ftp.sei.cmu.edu/pub/argus) and Shadow from SANS (http://www.nswc.navy.mil/ISSEC/CID) are the three free ones I know of. There are a number of commercial versions as well (Ballista, the ISS security scanner whatever its correct name is, and undoubtably others). Peter Van Epp / Operations and Technical Support Simon Fraser University, Burnaby, B.C. Canada
Re: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS
Author: Lachlan Cranswick
Date: Thu, 12 Nov 1998 00:00
Date: Thu, 12 Nov 1998 00:00
72 lines
3309 bytes
3309 bytes
Thanks muchly for this - though this still leaves a few 100 lines of
ASCII paranoia from the original post to give further enjoyment
to the masses!
One query (which makes TCPDUMP more informative) - can the Perl
be modified so it puts a path-file_name (if applicable) next to each packet:
i.e.,
16:43:27.278348 sv1.http > 151.104.78.243.4883: . 1:1461(1460) ack 169 win
61320 (DF) /doobry/main.html
16:43:27.278463 sv1.http > 151.104.78.243.4883: . 1461:2921(1460) ack 169 win
61320 (DF) /doobry/main.html
Please forgive the Perl cluelessness. (Which US president wrote the above
mod though?)
Lachlan.
>Lachlan Cranswick wrote:
>> <snip>
>> PS: Brings up another query - is there a tool that could do a TCPDUMP
>> and also tell what files are being transferred as part of the status
>> line with respect to http?
>> <snip alot of reports not cleaned up...>
>You guys are killing me :] try this -
>#!/usr/bin/perl
>
>$LIMIT = shift || 5000000;
>
>$|=1;
>open (STDIN,"/usr/sbin/tcpdump -lnx -s 1024 dst port 80 |");
>while (<>) {
> if (/^\S/) {
> last unless $LIMIT--;
> while ($packet=~/(GET|POST|WWW-Authenticate|Authorization).+/g) {
> print "$client -> $host\t$&\n";
> }
> undef $client; undef $host; undef $packet;
> ($client,$host) = /(\d+\.\d+\.\d+\.\d+).+ > (\d+\.\d+\.\d+\.\d+)/
> if /P \d+:\d+\((\d+)\)/ && $1 > 0;
> }
> next unless $client && $host;
> s/\s+//;
> s/([0-9a-f]{2})\s?/chr(hex($1))/eg;
> tr/\x1F-\x7E\r\n//cd;
> $packet .= $_;
>}
>Lincoln wrote the above, but it's more or less public domain.
>Enjoy!
>-Sneex- :]
>________________________________________________________________________
>Bill Jones | FCCJ Webmaster | x3089 | http://webmaster.fccj.org:81
>------------------------------------------------------------------------
> __ _ RedHat 5.1 Manhatten
> / /(_)_ __ _ ___ __ http://www.apache.org
> / / | | '_ \| | | \ \/ / http://www.redhat.com
> / /__| | | | | |_| |> < http://www.perl.com
> \____/_|_| |_|\__,_/_/\_\ http://www.gimp.org
Lachlan M. D. Cranswick
Collaborative Computational Project No 14 (CCP14)
for Single Crystal and Powder Diffraction
Daresbury Laboratory, Warrington, WA4 4AD U.K
Tel: +44 (0)1925-603703 Fax: +44 (0)1925-603124 Room C14
E-mail: l.cranswick@dl.ac.uk
CCP14 Webpage (Under heavy construction):
http://www.ccp14.ac.uk
Re: Distinguishing Attempted Denial of Service Attack (DoS) or non-DoS Network Problems - With Apache/Webserver? (plus Non resol...
Author: Marc Slemko
Date: Thu, 12 Nov 1998 00:00
Date: Thu, 12 Nov 1998 00:00
51 lines
3197 bytes
3197 bytes
In <l.cranswick.209.01C47D5D@dl.ac.uk> l.cranswick@dl.ac.uk (Lachlan Cranswick) writes: >(There was a previous security article about non-resolving IP addresses. >This may or may not be related?). >Are there tools or methods available for Web-serving/Apache/UNIX that >can help distinguishing between network misconfigs/slowness/nuances >vs attempted Denial of Services Attacks on the Web-server port? >I have some very wierd behaviour on the Apache 1.3.3 webserver >for SGI O2 running IRIX 6.3 - with DNS resolution enabled inside >the webserver. >An occassional occurance for me is to see the Apache 1.3.3 >server-status screen gives "Client" names of ???? >"Vhost" of ????? and "Request" of "reading... with very "bursty" >start/stop speeds. (1/2th to 1/20th of normal average throughput >from web-server to a local client PC when this is happening). >Nothing obvious in the default apache logs. How many of them? What percent of total connections were the "????" ones? What is happening in that case is a client is connecting and not making a request, but still tying up a child process. A type of DoS attack is possible by simply opening more and more connections until there are no more child processes. A netstat -n | grep ESTABLISHED should show the current connections, look for one remote IP with a lot of them. Symptoms of this include a lot of the ???? entries in the scoreboard, plus very long times until a response is started, but once a response is started it should be at around normal speed. Future versions of Apache should have a directive to let you tune the maximum number of connections that any single remote IP can have open at a single time. Note that this could also be caused by a broken client. A random NT box tried to make 10000 simultaneous connections to one of our web sites a while ago. The admin says he couldn't see anything odd on the box. [...] >TCPDUMP of 151.104.78.243 hitting the http port: >************************************************************ >16:43:20.314048 sv1.http > 151.104.78.243.4873: FP 5841:6006(165) ack 160 win 61320 (DF) Don't see anything too unusual there offhand.
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads