🚀 go-pugleaf

Simon Waters <Simon@wretched.demon.co.uk> writes:

> I seem to have a ppp connection hang after probes from Korean IP
> addresses to port 111. No other packets were logged - doesn't mean there
> weren't any!

If your firewall was up to scratch, you'd *know* there weren't any because
you'd be denying & logging everything by default.

> Several dozen log entries turn up as follows....
> 
> Apr 25 11:55:54 linux1 kernel: Packet log: input DENY ppp0 PROTO=17
> 211.39.194.151:742 a.b.c.d:111 L=84 S=0x00 I=65452 F=0x0000 T=44
> (#7)        
> 
> I have tightened the ipchains rules, and zapped portmapper from the box
> (I'm fairly sure nothing needed it *8)

It should never have been installed in the first place. (Korea, that is,
as well as portmapper.)

> Anyone know what aspect of this scan/attack causes the hang?

Nothing normally does. What you don't say is how much activity there is
after it's `hung'. You also don't say whether you're getting any malformed
packets, fragmentation problems, or what.

> I see no evidence that the box was compromised, so I assume

Have you run chkrootkit? Had a look in /etc/{inittab,inetd.conf} and
/dev/.lib and /var/named? Run an rpm -Vva? Monitored your network
connections with e.g. iptraf to see what's going where? Checked your
outgoing firewall logs?

> that the scan is just causing the interface to hang before anything
> nastier. Stopping and starting the ppp interface restores connectivity.

Consider what would happen if your box was port-scanning a large (/16)
network block over your modem and then you bounced ppp0; I'd expect an
overclogged connection that would appear like it's hung, and then maybe the
process/es responsible would die after the interface was downed.

In short, you're home but not even vigorously towelling off yet.

~Tim
-- 
All I see, All I know                       | piglet@stirfried.vegetable.org.uk
Is touching the sacred earth                | http://piglet.is.dreaming.org
And warming the hallowed ground             |