Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Two Cisco IP phones are flooding my PC with TCP packets of LEN 0. I don't have anything to do with these phones in the way of maintaining them... just wondering if anyone might know why they are doing this.

I've been having some problems with some suspected malware, so yesterday I reinstalled Windwos 7 on my PC. I've just been using Wireshark to monitor my network traffic (switched network, so I can only see stuff that's actually to/from me or broadcast).

Anyway yesterday everything was as it should be, but today when I fired up Wireshark I immediately noticed my PC is being bombarded with traffic from two hosts on my LAN.

I do not have access to these hosts, but I do know that they are Cisco IP phones (7960 series).

Here's what they're sending me:

10.0.0.100 10.0.0.21 TCP telnet > 44025 [SYN, ACK] Seq=0 Ack=0 Win=1400 Len=0 MSS=1000 10.0.0.101 10.0.0.21 TCP telnet > 44025 [SYN, ACK] Seq=0 Ack=0 Win=1400 Len=0 MSS=1000

They are both sending me these packets non-stop (even as I type this). I have no idea what the hell is going on. Could the phones have been compromised somehow? Is someone on the LAN trying to attack me?

I've scanned both 10.0.0.100 and .101, and as I thought they are the Cisco phones. 10.0.0.21 is my desktop. Both the phones have all ports filtered except port 23 (telnet) which is closed.

I can upload a capture file if that would help.

I just have no idea what is going on here... any suggestions would be appreciated.

Thanks!

share|improve this question

1 Answer 1

It sounds like the phones are configured incorrectly - or your PC has the wrong IP-address - I would have a word with whoever is responsible for the phones.

share|improve this answer
    
Kind of difficult, the person responsible for the phones (and LAN) has it in for me. I initially panicked and thought that he might be trying to attack my PC, but now I'm thinking it's just a misconfiguration. I'll try changing my MAC address so that I get a new IP and hopefully that will solve the problem. Thanks for the reply :) –  532 Dec 6 '10 at 11:27
    
Kind of difficult, the person responsible for the phones (and LAN) has it in for me - well it isn't like someone from here can dial in and turn off their misconfigured phones, so you still will have to go to them eventually. Perhaps you need to speak to their manager if you think they're doing this on purpose. –  RobM Dec 6 '10 at 12:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.