[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-Disclosure] Reverse flow RPC?
- To: full-disclosure@xxxxxxxxxxxxxxxx
- Subject: [Full-Disclosure] Reverse flow RPC?
- From: "Daniel H. Renner" <dan@xxxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: 26 Mar 2004 10:10:01 -0800
Hello list,
We're running IPCop v1.4.0a10 on a DHCP ADSL connection. Snort is the
IDS software installed.
I took a look-see at my firewall log for yesterday and saw four
instances of what appears to be reversed incoming RPC traffic on the Red
(WAN/eth2) side.
I had this sort of a scenario before, but it was reversed port 80
traffic. I Googled to no avail, and I also reported it to this list and
never was able to figure our what the heck causes this type of traffic,
so when it cropped up again I'm still at a loss - any clues?
Time Chain Iface Proto Source Src Port
MAC Address Destination Dst Port
21:01:42 NEW not SYN? eth2 TCP 4.62.174.132 1025
00:02:3b:01:6b:ed 4.62.xxx.xxx 1820
20:29:44 NEW not SYN? eth2 TCP 4.62.174.132 1025
00:02:3b:01:6b:ed 4.62.xxx.xxx 1509
19:57:13 NEW not SYN? eth2 TCP 4.62.174.132 1025
00:02:3b:01:6b:ed 4.62.xxx.xxx 1206
19:57:47 NEW not SYN? eth2 TCP 4.62.174.132 1025
00:02:3b:01:6b:ed 4.62.xxx.xxx 1966
--
TIA,
Dan Renner
President
Los Angeles Computerhelp
http://losangelescomputerhelp.com
818.352.8700
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html