-p udp and --ctstate NEW

DISCUSSION /dev/rob0 1 participant 1 message Nov 17, 2010

Share & tools

/dev/rob0

author

2010-11-17 00:15 UTC #0 lore raw

I'm experimenting with -m recent to stem SIP attacks. As part of the experiment I have a --ctstate NEW -p udp --dport 5060 -j LOG rule to log new SIP "connections".

I'm currently under attack from 61.135.88.173 in China, and the strange thing was that all those LOG lines were identical except for slight fluxuations in length. All same source port, 5164. (The length fluxuations make sense, I saw part of the attack as it began, and it was running through a dictionary of names.)

What I'm curious about is how those were all --ctstate NEW, why not ESTABLISHED? I thought the same source.IP:sport -> dest.IP:dport would be seen as ESTABLISHED.

Asterisk console snippet of the attack before blocking:

[Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"hannibal"<sip:[email protected]>' failed for '61.135.88.173' - No matching peer found [Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"hannible"<sip:[email protected]>' failed for '61.135.88.173' - No matching peer found [Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"harding"<sip:[email protected]>' failed for '61.135.88.173' - No matching peer found [Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"harrison"<sip:[email protected]>' failed for '61.135.88.173' - No matching peer found [Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"harvard"<sip:[email protected]>' failed for '61.135.88.173' - No matching peer found [Nov 16 16:39:23] NOTICE[2072]: chan_sip.c:21639 handle_request_register: Registration from '"hathaway"<sip:[email protected]>' failed for '61.135.88.173' - No matching peer found

LOG rules:
[1:362] -A BadGuy -p udp -j LOG --log-prefix "SIP attacker: "
...
[19:6866] -A WAN -p udp -m conntrack --ctstate NEW -m udp --dport 5060 -j LOG --log-prefix "NEW SIP: "

$ dmesg | tail -20
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=360 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=340
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=359 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=339
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=361 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=341
NEW SIP: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342
SIP attacker: IN=eth1 OUT= MAC=00:12:9b:aa:ae:2b:00:17:e1:2d:fa:3f:09:00 SRC=61.135.88.173 DST=192.0.2.160 LEN=362 TOS=0x00 PREC=0x00 TTL=44 ID=0 DF PROTO=UDP SPT=5164 DPT=5060 LEN=342

Signature · 2 lines

    Offlist mail to this address is discarded unless
    "/dev/rob0" or "not-spam" is in Subject: header