Skip to contentSkip to conversation

lots of tcp port 445 traffic

DISCUSSION ro0ot 3 participants 5 messages Dec 6, 2004 – Dec 10, 2004

lore
Share & tools
lore

ro0ot

author
#0 lore raw

Hi,

I get lots of tcp port 445 traffic when I do a tcpdump -n port 445, could it be an attack?

I check on the syslog files at /var/log/syslog, it shows this as below: -

Dec  7 00:36:40 fw01 kernel: Neighbour table overflow.
Dec  7 00:36:46 fw01 kernel: NET: 32 messages suppressed.
Dec  7 00:36:46 fw01 kernel: Neighbour table overflow.
Dec  7 00:36:51 fw01 kernel: NET: 27 messages suppressed.
Dec  7 00:36:51 fw01 kernel: Neighbour table overflow.
Dec  7 00:38:14 fw01 kernel: NET: 6 messages suppressed.
Dec  7 00:38:14 fw01 kernel: Neighbour table overflow.

When I try to ping my router IP address, I get this message below: -

connect: No buffer space available

I did tried running the below command and it seems not helping much: -

iptables -I cus2jarwan -p tcp --dport 445 -j REJECT --reject-with tcp-reset

or

iptables -I cus2jarwan -p tcp --dport 445 -j DROP

How can I stop this tcp port 445 traffic? Or how can I prevent it?

Regards,
ro0ot

#1 lore raw
Quoted 4 lines · On Tue, 07 Dec 2004 00:54:08 +0800, ro0ot <[email protected]> wrote:

Hi,

I get lots of tcp port 445 traffic when I do a tcpdump -n port 445, could it be an attack?

Many viruses hammer TCP port 445 attempting to exploit MS Windows vulnerabilities. They attempt to establish TCP sessions on dport 445 to a massive amount of P addresses.. this can fill up /proc/net/ip_conntrack in no time, amongst other things.

Quoted 15 lines

I check on the syslog files at /var/log/syslog, it shows this as below: -

Dec  7 00:36:40 fw01 kernel: Neighbour table overflow.
Dec  7 00:36:46 fw01 kernel: NET: 32 messages suppressed.
Dec  7 00:36:46 fw01 kernel: Neighbour table overflow.
Dec  7 00:36:51 fw01 kernel: NET: 27 messages suppressed.
Dec  7 00:36:51 fw01 kernel: Neighbour table overflow.
Dec  7 00:38:14 fw01 kernel: NET: 6 messages suppressed.
Dec  7 00:38:14 fw01 kernel: Neighbour table overflow.

When I try to ping my router IP address, I get this message below: -

connect: No buffer space available

Quoted 8 lines

I did tried running the below command and it seems not helping much: -

iptables -I cus2jarwan -p tcp --dport 445 -j REJECT --reject-with tcp-reset

or

iptables -I cus2jarwan -p tcp --dport 445 -j DROP

You definately don't want to use -J REJECT - this will do more harm than good, as it will be generating an ICMP unreachable message for each port 445 packet.

Quoted 1 line

How can I stop this tcp port 445 traffic? Or how can I prevent it?

Use the drop rule you mentioned. Apply it to INPUT and also FORWARD.

If possible;
- remove the viruses
- disable the infected computer(s) switch port(s) until cleaned
- unplug the infected computer(s) from the network until cleaned

Regards,
Paul

Quoted 5 lines

Regards,
ro0ot

#2 lore raw
In reply to ro0ot
Quoted 23 lines · El lun, 06 de 12 de 2004 a las 17:54, ro0ot escribió:

Hi,

I get lots of tcp port 445 traffic when I do a tcpdump -n port 445, could it be an attack?

I check on the syslog files at /var/log/syslog, it shows this as below: -

Dec  7 00:36:40 fw01 kernel: Neighbour table overflow.
Dec  7 00:36:46 fw01 kernel: NET: 32 messages suppressed.
Dec  7 00:36:46 fw01 kernel: Neighbour table overflow.
Dec  7 00:36:51 fw01 kernel: NET: 27 messages suppressed.
Dec  7 00:36:51 fw01 kernel: Neighbour table overflow.
Dec  7 00:38:14 fw01 kernel: NET: 6 messages suppressed.
Dec  7 00:38:14 fw01 kernel: Neighbour table overflow.

When I try to ping my router IP address, I get this message below: -

connect: No buffer space available

I did tried running the below command and it seems not helping much: -

iptables -I cus2jarwan -p tcp --dport 445 -j REJECT --reject-with tcp-reset

Quoted 9 lines

or

iptables -I cus2jarwan -p tcp --dport 445 -j DROP

How can I stop this tcp port 445 traffic? Or how can I prevent it?

Regards,
ro0ot

I also receive tons of this kind of traffic, like anyone else, I suppose. The way you stop them it's correct, maybe you don't have the rule in the correct chain, because it works ok for me.

Signature · 12 lines
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
[email protected]
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"
#3 lore raw
Quoted 10 lines
Quoted 6 lines

iptables -I cus2jarwan -p tcp --dport 445 -j REJECT --reject-with tcp-reset

or

iptables -I cus2jarwan -p tcp --dport 445 -j DROP

You definately don't want to use -J REJECT - this will do more harm than good, as it will be generating an ICMP unreachable message for each port 445 packet.

My mistake - I didn't notice you were using "--reject-with tcp-reset". Pretty sure you'd be better off with DROP anyway.

Regards,
Paul

author
#4 lore raw

I include these rules below and it helps: -

iptables -t nat -A PREROUTING -p tcp --dport 135 -j DROP iptables -t nat -A PREROUTING -p tcp --dport 445 -j DROP

Quoted 23 lines · Paul Annesley
Quoted 4 lines
Quoted 4 lines

iptables -I cus2jarwan -p tcp --dport 445 -j REJECT --reject-with tcp-reset

or

Quoted 9 lines
Quoted 4 lines

iptables -I cus2jarwan -p tcp --dport 445 -j DROP

You definately don't want to use -J REJECT - this will do more harm than good, as it will be generating an ICMP unreachable message for each port 445 packet.

My mistake - I didn't notice you were using "--reject-with tcp-reset". Pretty sure you'd be better off with DROP anyway.

Regards,
Paul