Date: Sat, 28 Feb 2004 02:14:05 +1100 From: Tony Frank <tfrank@optushome.com.au> To: Gleb Smirnoff <glebius@cell.sick.ru>, Iasen Kostov <tbyte@OTEL.net>, freebsd-net@freebsd.org Subject: Re: Bad loopback traffic not stopped by ipfw. Message-ID: <20040227151405.GA5540@marvin.home.local> In-Reply-To: <20040225142134.GA86436@cell.sick.ru> References: <200402242315.i1ONFbmZ028103@soth.ventu> <403C9705.3060108@OTEL.net> <10324604148.20040225164703@b-o.ru> <20040225141642.GB86194@cell.sick.ru> <403CAF07.5040906@OTEL.net> <20040225142134.GA86436@cell.sick.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi all, On Wed, Feb 25, 2004 at 05:21:34PM +0300, Gleb Smirnoff wrote: > On Wed, Feb 25, 2004 at 04:19:51PM +0200, Iasen Kostov wrote: > I> >>16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > > I> >>192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0 > I> > > I> >This is some kind of Win32 virus. This floods can be easily > I> >stopped by ipfw rule: > I> > > I> >deny tcp from any to any tcpflags rst,ack > I> > > I> These packets never reach IPFW as we can see. > > Ughu. Really. > But I have millions of them from non-localhost addresses. > This maybe is of interest? http://www.dshield.org/pipermail/list/2004-January/014027.php Regards, Tony
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040227151405.GA5540>