a dos?
Hi all,
Don't know if this is the appropriate place to ask so if not please just ignore.
There is some unexplained, non-stop traffic that won't go away.
27.50.2.191:80 keeps calling me at 63.192.15.229:4460.
tcpdump shows 2 types of Flags: [S.] and [.], each one's packet numbers never change. Almost all of the packets are type 1.
1)
16:27:05.947510 IP 27.50.2.191.80 > 63.192.15.229.4460: Flags [S.], seq 777598812, ack 3826171711, win 65535, length 0
2)
16:27:06.100035 IP 27.50.2.191.80 > 63.192.15.229.4460: Flags [.], ack 1246380345, win 0, length 0
There is nothing listening at 63.192.15.229.
Would any network gurus be willing to explain to me what may be going on or provide me insight?
Something puzzling was that the source IP may be related to the DEBOGON Project?
I know I can't stop incomers. Do I just put up with this until it a) gets fixed; b) goes away?
Thanks
Quoted 9 lines · Mike Wright
Hi all,
Don't know if this is the appropriate place to ask so if not please just ignore.
There is some unexplained, non-stop traffic that won't go away.
27.50.2.191:80 keeps calling me at 63.192.15.229:4460.
tcpdump shows 2 types of Flags: [S.] and [.], each one's packet numbers never change. Almost all of the packets are type 1.
The [S.] is likely step 2 of the 3-way handshake in making a TCP connection. If you're not sending syns to 27.50.2.191:80, then perhaps someone else is, either as an attack against 27.50.2.191, or because they're using your IP space (likely on a private network) and have leaky NAT.
Quoted 1 line
Something puzzling was that the source IP may be related to the DEBOGON Project?
Why do you think that?
----------------------------------------------------------------------
Jon Lewis, MCP :) | I route
| therefore you are_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
Quoted 7 lines · Jon Lewis
Quoted 5 lines · Mike Wright
Hi all,
Don't know if this is the appropriate place to ask so if not please just ignore.
Quoted 7 lines
Quoted 6 lines
There is some unexplained, non-stop traffic that won't go away.
27.50.2.191:80 keeps calling me at 63.192.15.229:4460.
tcpdump shows 2 types of Flags: [S.] and [.], each one's packet numbers never change. Almost all of the packets are type 1.
Thanks for your help.
Quoted 11 lines
The [S.] is likely step 2 of the 3-way handshake in making a TCP connection. If you're not sending syns to 27.50.2.191:80, then perhaps someone else is, either as an attack against 27.50.2.191, or because they're using your IP space (likely on a private network) and have leaky NAT.
Quoted 2 lines
Something puzzling was that the source IP may be related to the DEBOGON Project?
Why do you think that?
From their whois info:
route: 27.50.0.0/22 descr: APNIC debogon project testing