Paul, I'm seeing the same thing now. It caught my eye because of another oddity that occurs from those IP's and I wanted to check with you if you see that as well. These addresses (about a dozen IP's from China in my case) also send a TCP SYN packet with 24 '0x00' bytes payload to port 53. Seq # and Ack # are set, windows size is 2048 (although I haven't confirmed that with all past scans). Below is a tcpdump. See if that looks familiar :) So it doesn't appear to be targeted just at UT Dallas. I start to wonder if other sites get hit too, but if that flies under the radar. Also, there is no name server at that address, never has been. The IP being targeted is the global NAT IP of a firewall. All outbound connections come from that IP. No other IP (in a two class C range) is being hit. This has started on a regular basis last week and seems steady: 2004-05-15 | 10 2004-05-21 | 9 2004-06-15 | 6 2004-07-07 | 6 2004-07-25 | 94 2004-07-26 | 22 2004-07-28 | 211 2004-07-29 | 281 2004-07-30 | 211 2004-07-31 | 312 2004-08-01 | 307 2004-08-02 | 274 2004-08-03 | 111 (so far) There are about 18 sources involved, but the majority of the packets are coming from 218.75.110.194 (601), 61.135.158.28 (589), and 61.135.158.29 (451), all three from China. All unsolicited incoming packets. Nothing is part of any kind of communication (i.e. response to web browsing, triggering web bugs, p2p, IM, etc). Paul, were you able to find anything out about this? Do those IP's correlate with your captured IP's? Do you see the TCP SYN too? Is anyone else seeing this pattern? Regards, Frank tcpdump: 21:16:15.434753 218.75.110.194.3847 > x.x.x.x.53: [udp sum ok] 51621 NS? . (17) (ttl 44, id 51622, len 45) 21:16:16.194129 218.75.110.194.3847 > x.x.x.x.53: [udp sum ok] 51622 NS? . (17) (ttl 44, id 51623, len 45) 21:16:16.932505 218.75.110.194.3847 > x.x.x.x.53: [udp sum ok] 51623 NS? . (17) (ttl 44, id 51624, len 45) 21:16:18.431546 218.75.110.194.3847 > x.x.x.x.53: [udp sum ok] 9949 PTR? x.x.x.x.in-addr.arpa. (45) (ttl 44, id 9950, len 73) 21:16:19.186279 218.75.110.194.3847 > x.x.x.x.53: [udp sum ok] 9950 PTR? x.x.x.x.in-addr.arpa. (45) (ttl 44, id 9951, len 73) 21:16:19.939409 218.75.110.194.3847 > x.x.x.x.53: [udp sum ok] 9951 PTR? x.x.x.x.in-addr.arpa. (45) (ttl 44, id 9952, len 73) 21:16:21.433511 218.75.110.194.53 > x.x.x.x.33434: [udp sum ok] 10344 FormErr [0q] 0/0/0 (36) (ttl 44, id 10344, len 64) 21:16:22.196164 218.75.110.194.53 > x.x.x.x.33434: [udp sum ok] 10345 FormErr [0q] 0/0/0 (36) (ttl 44, id 10345, len 64) 21:16:22.995559 218.75.110.194.53 > x.x.x.x.33434: [udp sum ok] 10346 FormErr [0q] 0/0/0 (36) (ttl 44, id 10346, len 64) 21:16:24.448425 218.75.110.194.1758 > x.x.x.x.53: S [tcp sum ok] 3939495989:3939496013(24) win 2048 0 [0q] (22) (ttl 44, id 1, len 64) 21:16:25.208289 218.75.110.194.1794 > x.x.x.x.53: S [tcp sum ok] 3774103031:3774103055(24) win 2048 0 [0q] (22) (ttl 44, id 2, len 64) 21:16:26.005612 218.75.110.194.1821 > x.x.x.x.53: S [tcp sum ok] 992083552:992083576(24) win 2048 0 [0q] (22) (ttl 44, id 3, len 64) 21:16:27.441872 218.75.110.194 > x.x.x.x: icmp: echo request (ttl 44, id 32512, len 64) 21:16:28.191483 218.75.110.194 > x.x.x.x: icmp: echo request (ttl 44, id 32747, len 64) 21:16:28.949630 218.75.110.194 > x.x.x.x: icmp: echo request (ttl 44, id 32997, len 64) 21:16:41.758970 218.75.110.194 > x.x.x.x: icmp: echo request (ttl 44, id 36248, len 64) 21:16:42.166118 218.75.110.194 > x.x.x.x: icmp: echo request (ttl 44, id 36448, len 64) 21:16:42.898505 218.75.110.194 > x.x.x.x: icmp: echo request (ttl 44, id 36627, len 64) On Sun, 2004-07-25 at 13:57, Paul Schmehl wrote: > 22:06:10.294071 x.x.x.x.2566 > targethost.utdallas.edu.domain: 29462 NS? . > (17) > 22:06:11.043050 x.x.x.x.2566 > targethost.utdallas.edu.domain: 29463 NS? . > (17) > 22:06:11.791218 x.x.x.x.2566 > targethost.utdallas.edu.domain: 29464 NS? . > (17) > 22:06:13.298805 x.x.x.x.2566 > targethost.utdallas.edu.domain: 30290 PTR? > 63.37.110.129.in-addr.arpa. (44) > 22:06:14.052600 x.x.x.x.2566 > targethost.utdallas.edu.domain: 30291 PTR? > 63.37.110.129.in-addr.arpa. (44) > 22:06:14.799270 x.x.x.x.2566 > targethost.utdallas.edu.domain: 30292 PTR? > 63.37.110.129.in-addr.arpa. (44)
Attachment:
signature.asc
Description: This is a digitally signed message part