Two Cisco IP phones are flooding my PC with TCP packets of LEN 0. I don't have anything to do with these phones in the way of maintaining them... just wondering if anyone might know why they are doing this.
I've been having some problems with some suspected malware, so yesterday I reinstalled Windwos 7 on my PC. I've just been using Wireshark to monitor my network traffic (switched network, so I can only see stuff that's actually to/from me or broadcast).
Anyway yesterday everything was as it should be, but today when I fired up Wireshark I immediately noticed my PC is being bombarded with traffic from two hosts on my LAN.
I do not have access to these hosts, but I do know that they are Cisco IP phones (7960 series).
Here's what they're sending me:
10.0.0.100 10.0.0.21 TCP telnet > 44025 [SYN, ACK] Seq=0 Ack=0 Win=1400 Len=0 MSS=1000 10.0.0.101 10.0.0.21 TCP telnet > 44025 [SYN, ACK] Seq=0 Ack=0 Win=1400 Len=0 MSS=1000
They are both sending me these packets non-stop (even as I type this). I have no idea what the hell is going on. Could the phones have been compromised somehow? Is someone on the LAN trying to attack me?
I've scanned both 10.0.0.100 and .101, and as I thought they are the Cisco phones. 10.0.0.21 is my desktop. Both the phones have all ports filtered except port 23 (telnet) which is closed.
I can upload a capture file if that would help.
I just have no idea what is going on here... any suggestions would be appreciated.