3:54 a.m.
I was just noticing, while trying to reload a machine with FC1 (long
story- don't ask) I was watching the log and noticed something I noticed
earlier:
Aug 10 03:45:24 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=18935 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
Aug 10 03:45:30 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=20211 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
<slight delay here and then:>
Aug 10 03:45:45 evv kernel: martian destination 0.0.0.0 from 65.218.63.155, dev eth1
I'm no firewall-guru, but this having happened more than once, I get
the feeling our new SSH-hacking friend might be trying to get around the
firewall.
Does anyone else concur?
--
------------------------------------------------------------------------
Brian Fahrländer Christian, Conservative, and Technomad
Evansville, IN http://www.fahrlander.net
ICQ 5119262
AIM: WheelDweller
------------------------------------------------------------------------
7:24 a.m.
I don't see it, I see two inbound packets
to your eth1 inbound.
SRC IP: 221.15.178.84
DST IP: 63.69.210.36
PROTO: TCP
SPT: 4262
DPT: 1025
SYN PACKET
I would look here for more details on TCP port 1025:
http://www.incidents.org/port_details.php?port=1025
On Tue, 2004-08-10 at 04:54, Brian Fahrlander wrote:
I was just noticing, while trying to reload a machine with FC1
(long
story- don't ask) I was watching the log and noticed something I noticed
earlier:
Aug 10 03:45:24 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=18935 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
Aug 10 03:45:30 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=20211 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
<slight delay here and then:>
Aug 10 03:45:45 evv kernel: martian destination 0.0.0.0 from 65.218.63.155, dev eth1
I'm no firewall-guru, but this having happened more than once, I get
the feeling our new SSH-hacking friend might be trying to get around the
firewall.
Does anyone else concur?
8 a.m.
On Tue, 2004-08-10 at 04:54, Brian Fahrlander wrote:
I was just noticing, while trying to reload a machine with FC1
(long
story- don't ask) I was watching the log and noticed something I noticed
earlier:
Aug 10 03:45:24 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=18935 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
Aug 10 03:45:30 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=20211 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
<slight delay here and then:>
Aug 10 03:45:45 evv kernel: martian destination 0.0.0.0 from 65.218.63.155, dev eth1
I'm no firewall-guru, but this having happened more than once, I get
the feeling our new SSH-hacking friend might be trying to get around the
firewall.
Does anyone else concur?
Double check your system and make sure port 1025 is closed or disabled.
That appears to be the port they are trying to hit. What I find
interesting is the MAC address info. It appears to be a IPV6 MAC
address not a IPV4 (to many octets). If you don't need IPV6 you may
want to disable that as well.
A quick google on port 1025 had it listed in one place as network
blackjack. Not sure how accurate that is. But most likely this just
someone scanning various ports for something open or for a specific
exploit on a service that uses port 1025.
--
Scot L. Harris <webid(a)cfl.rr.com>
8:11 a.m.
ipv4 and ipv6 operate at a layer that is different from the physical
card. There is no such thingas an ipv6 mac address.
On Tue, 10 Aug 2004 09:00:51 -0400, Scot L. Harris <webid(a)cfl.rr.com> wrote:
On Tue, 2004-08-10 at 04:54, Brian Fahrlander wrote:
> I was just noticing, while trying to reload a machine with FC1 (long
> story- don't ask) I was watching the log and noticed something I noticed
> earlier:
>
> Aug 10 03:45:24 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=18935 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
> Aug 10 03:45:30 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=20211 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
>
> <slight delay here and then:>
> Aug 10 03:45:45 evv kernel: martian destination 0.0.0.0 from 65.218.63.155, dev
eth1
>
>
> I'm no firewall-guru, but this having happened more than once, I get
> the feeling our new SSH-hacking friend might be trying to get around the
> firewall.
>
> Does anyone else concur?
Double check your system and make sure port 1025 is closed or disabled.
That appears to be the port they are trying to hit. What I find
interesting is the MAC address info. It appears to be a IPV6 MAC
address not a IPV4 (to many octets). If you don't need IPV6 you may
want to disable that as well.
A quick google on port 1025 had it listed in one place as network
blackjack. Not sure how accurate that is. But most likely this just
someone scanning various ports for something open or for a specific
exploit on a service that uses port 1025.
--
Scot L. Harris <webid(a)cfl.rr.com>
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
8:58 a.m.
On Tue, 2004-08-10 at 09:11, Erik Espinoza wrote:
ipv4 and ipv6 operate at a layer that is different from the physical
card. There is no such thingas an ipv6 mac address.
I stand corrected. What looks like a MAC address does look weird.
Unless that is not a MAC address?
> Aug 10 03:45:24 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84
DST=63.69.210.36 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=18935 DF PROTO=TCP
SPT=4262 DPT=1025 WINDOW=64240 RES=0x00 SYN URGP=0
> Aug 10 03:45:30 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84
DST=63.69.210.36 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=20211 DF PROTO=TCP
SPT=4262 DPT=1025 WINDOW=64240 RES=0x00 SYN URGP=0
>
--
Scot L. Harris <webid(a)cfl.rr.com>
11:49 a.m.
On Tue, 2004-08-10 at 09:58, Scot L. Harris wrote:
On Tue, 2004-08-10 at 09:11, Erik Espinoza wrote:
> ipv4 and ipv6 operate at a layer that is different from the physical
> card. There is no such thingas an ipv6 mac address.
I stand corrected. What looks like a MAC address does look weird.
Unless that is not a MAC address?
> > Aug 10 03:45:24 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84
DST=63.69.210.36 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=18935 DF PROTO=TCP
SPT=4262 DPT=1025 WINDOW=64240 RES=0x00 SYN URGP=0
> > Aug 10 03:45:30 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84
DST=63.69.210.36 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=20211 DF PROTO=TCP
SPT=4262 DPT=1025 WINDOW=64240 RES=0x00 SYN URGP=0
> >
Scott,
Actually, the MAC= is the entire Layer 2 header. It is the Destination
MAC, followed by the Source MAC, and finally the "EtherType" field. So
apparently using Ethernet v2 framing as opposed to one of the IEEE
sanctioned ones...
So, in your case:
Destination MAC: 00:00:c0:d9:5b:98
Source MAC: 00:01:30:08:dc:00
EtherType: 08:00
Remember that MAC addresses are for the local LAN segment, so it is
probably between a machine and a router....
Also, the EtherType of 0800 is for "IP", essentially a flag to tell a
system what Layer 3 handler to pass up to.
HTH,
--Rob
9:57 a.m.
Scot L. Harris wrote:
A quick google on port 1025 had it listed in one place as network
blackjack. Not sure how accurate that is. But most likely this just
someone scanning various ports for something open or for a specific
exploit on a service that uses port 1025.
IIRC, Windows uses the ports immediately above 1024 for a variety of
readily-exploitable services. Configure the firewall to reject new
connections on those ports. My experience is that ports 1025-1030 are
the most common targets.
--
-John (john(a)os2.dhs.org)
9:53 a.m.
Brian Fahrlander wrote:
I was just noticing, while trying to reload a machine with FC1
(long
story- don't ask) I was watching the log and noticed something I noticed
earlier:
Aug 10 03:45:24 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=18935 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
Aug 10 03:45:30 evv kernel: firewall: IN=eth1 OUT=
MAC=00:00:c0:d9:5b:98:00:01:30:08:dc:00:08:00 SRC=221.15.178.84 DST=63.69.210.36 LEN=48
TOS=0x00 PREC=0x00 TTL=109 ID=20211 DF PROTO=TCP SPT=4262 DPT=1025 WINDOW=64240 RES=0x00
SYN URGP=0
<slight delay here and then:>
Aug 10 03:45:45 evv kernel: martian destination 0.0.0.0 from 65.218.63.155, dev eth1
I'm no firewall-guru, but this having happened more than once, I get
the feeling our new SSH-hacking friend might be trying to get around the
firewall.
Does anyone else concur?
No, I think this is a separate event. The IP addesses don't match.
--
-John (john(a)os2.dhs.org)
7201
days inactive
7201
days old
7 comments
6 participants
participants (6)
-
Brian Fahrlander -
dave -
Erik Espinoza -
John Thompson -
Robert Locke -
Scot L. Harris