From owner-freebsd-net@FreeBSD.ORG  Wed Feb 25 06:12:18 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id F381E16A4CE
	for <freebsd-net@freebsd.org>; Wed, 25 Feb 2004 06:12:17 -0800 (PST)
Received: from mail.otel.net (gw3.OTEL.net [212.36.8.151])
	by mx1.FreeBSD.org (Postfix) with ESMTP id ACCA743D41
	for <freebsd-net@freebsd.org>; Wed, 25 Feb 2004 06:12:17 -0800 (PST)
	(envelope-from tbyte@OTEL.net)
Received: from dragon.otel.net ([212.36.8.135] helo=OTEL.net)
	by mail.otel.net with esmtp (Exim 4.30; FreeBSD)
	id 1Avzln-000DLp-Iz; Wed, 25 Feb 2004 16:12:15 +0200
Message-ID: <403CAD41.10401@OTEL.net>
Date: Wed, 25 Feb 2004 16:12:17 +0200
From: Iasen Kostov <tbyte@OTEL.net>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko/20040224
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Andrew Riabtsev <resident@b-o.ru>
References: <200402242315.i1ONFbmZ028103@soth.ventu>
	<403C9705.3060108@OTEL.net> <10324604148.20040225164703@b-o.ru>
In-Reply-To: <10324604148.20040225164703@b-o.ru>
Content-Type: text/plain; charset=windows-1251; format=flowed
Content-Transfer-Encoding: 8bit
cc: freebsd-net@freebsd.org
Subject: Re: Bad loopback traffic not stopped by ipfw.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Feb 2004 14:12:18 -0000

Andrew Riabtsev wrote:

>Привет Iasen,
>
>Wednesday, February 25, 2004, 3:37:25 PM, you wrote:
>
>IK> netstat -s -p ip
>IK> .
>IK> .
>IK> .
>IK>         3575124 datagrams with bad address in header
>
>IK>     Could it be this that drops "bad" packets before they enter the IPFW ?
>
>To me it would be also interesting to know where this traffic comes
>from. I have same on my local net:
>
># tcpdump -neifxp0 src or dst 127.0.0.1
>tcpdump: listening on fxp0
>16:26:23.280737 0:50:fc:ed:d4:4 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.141.148.1928: R 0:0(0) ack 1986723841 win 0
>16:26:23.285831 0:d:61:e:3f:c3 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.213.167.1571: R 0:0(0) ack 812253185 win 0
>16:26:23.287642 0:1:2:9c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0
>16:26:23.297289 0:4:79:68:14:9c 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.214.208.1997: R 0:0(0) ack 1905917953 win 0
>16:26:23.297555 0:c0:df:13:87:c4 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.53.212.1836: R 0:0(0) ack 1137442817 win 0
>
>dst mac-address is mac of fxp0 and src addresses is macs from local
>net not just nonexistent macs. It could be some kind of attack or it
>is flood from broken device in local net or maybe something else, i'll
>try to find it out. Let me know if You find out something new.
>
> Andrew                            mailto:resident@b-o.ru
>
>
>  
>
    Yes I see milions of packets of that type too ... What is the OS of 
the computer sending this packets ? It could be a trojan-flooder or 
something like that or a broken wind0ze driver ...