Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Below is the specific traffic monitored at the network perimeter and originating from a user PC on Vista platform.

My question is not about the effects of the flood, but about the nature of the source of it. Is this some known infection, or just an application went out of control? a standard NOD32 scan didn't find anything, as the user told me.

Thank you for any hint.

14:40:10.115876 IP > S 2742536765:2742536765(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.115943 IP > S 3071079888:3071079888(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116015 IP > S 3445199428:3445199428(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116086 IP > S 2053198691:2053198691(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116154 IP > S 2841660872:2841660872(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116222 IP > S 3150822465:3150822465(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116290 IP > S 1692515021:1692515021(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116358 IP > S 3358275919:3358275919(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116430 IP > S 930184999:930184999(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116498 IP > S 1504984630:1504984630(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116566 IP > S 546074424:546074424(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116634 IP > S 4241828590:4241828590(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116702 IP > S 668634627:668634627(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.116769 IP > S 3768119461:3768119461(0) win 16384 <mss 1460,nop,nop,sackOK>
14:40:10.117360 IP >  12676 op8 Resp12*- [2128q][|domain]
14:40:10.117932 IP >  44190 op7 NotAuth*|$ [29103q],[|domain]
14:40:10.118726 IP >  49196 inv_q [b2&3=0xeea] [64081q] [28317a] [43054n] [23433au] Type63482 (Class 5889)? M-_^OS>M-JM-m^_M-i.[|domain]
14:40:10.119934 IP >  48131 updateMA Resp12$ [43850q],[|domain]
14:40:10.121164 IP >  46330 updateM% [b2&3=0x665b] [23691a] [998q] [32406n] [11452au][|domain]
14:40:10.121866 IP >  34425 op7 YXRRSet* [39927q][|domain]
14:40:10.123107 IP >  56536 notify+ [b2&3=0x27e6] [59761a] [23005q] [33341n] [29705au][|domain]
14:40:10.123961 IP >  19323 stat% [b2&3=0x14bb] [32491a] [41925q] [2038n] [5857au][|domain]
14:40:10.132499 IP >  50432 updateMA+ [b2&3=0x6bc2] [10733a] [9775q] [46984n] [15261au][|domain]
14:40:10.133394 IP >  2171 notify Refused$ [26027q][|domain]
14:40:10.134421 IP >  25802 updateM NXDomain*-$ [28641q][|domain]
14:40:10.135392 IP >  2073 updateMA+ [b2&3=0x6d0b] [43177a] [54332q] [17736n] [43636au][|domain]
14:40:10.136638 IP >  15346 updateD+% [b2&3=0x577a] [61686a] [19106q] [15824n] [37833au] Type28590 (Class 64856)? [|domain]
14:40:10.137265 IP >  60761 update+ [b2&3=0x2b66] [43293a] [53922q] [23115n] [11349au][|domain]
14:40:10.148122 IP >  3418 op3% [b2&3=0x1a92] [51107a] [60368q] [47777n] [56081au][|domain]
share|improve this question

migrated from Jun 17 '10 at 15:52

This question came from our site for computer enthusiasts and power users.

recommend reformatting data to make it human-parsable;) – Andy Jun 17 '10 at 14:33
@radudani: this question will be migrated to our sister site, Server Fault. you will need to register your account here and there with the same OpenID to regain ownership of the question. – quack quixote Jun 17 '10 at 15:52

Since both of the DNS servers being hit are at softlayer, a fairly well known hosting company.

First question would be, why would your machine be getting DNS from there. Since the machine is a client machine and not a server, it isn't like you would be running nameservice from that machine, so, I would suspect something is redirecting DNS requests for a particular app there. It is somewhat common for zombie botnet processes to use their own DNS servers so that they can redirect their zombies to connect to a command and control network of their choosing. Both IP addresses appear non-responsive, and don't appear to be answering DNS queries, so it is possible it was an exploited machine that was taken down.

The fact that you actually logged successful requests and now that machine isn't responding gives another data point that something isn't quite right.

I'd pull that box off the network and do a scan to see if it finds any malware.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.