Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I eventually sometimes watch most initial tcp connection attempts like this:

tcpdump -nn -Z somepcapuser not src host (12x.x5.109.xxx or 62.75.160.xxx ) and not (port 9001 or 443 or 8080 ) and tcp[tcpflags]&(tcp-syn) !=0 and not tcp[tcpflags]& (tcp-ack) !=0 or icmp

this works pretty well to quickly identify oddness so far. However, I now have a question on the following output:

03:53:52.227884 IP 203.81.166.20.53786 > 62.75.160.xxx.80: S 846930886:846930886(0) win 61690 "<"mss 1460,nop,nop,sackOK,opt-178:f04700000000,nop,wscale 4">"

I wonder what the marked portion means, haven't seen that before.

Thanks for help wlaus

share|improve this question
    
ok, [here is the promised dump][1] [1]: dl.netbeisser.de/fullsnap.cap.gz –  user72764 Mar 2 '11 at 11:56

4 Answers 4

This is TCP options. tcpdump can understand it. I'm not sure, but look like timestamp:

f04700 - current timestamp
000000 - previous timestamp

178 is probably offset from the start TCP options

share|improve this answer
    
Hm, you might be right, however newer tcpdump reports it as: "Flags [S], seq 846930886, win 61690, options [mss 1460,nop,nop,sackOK,Unknown Option 178f04700000000,nop,wscale 4], length 0" and wireshark says "broken TCP" (ack field set, while ack bit is not), will provide some full capture later this day. –  wlaus Mar 2 '11 at 5:05

Maybe try feeding tcpdump capture to Wireshark? It nicely spells out meaning of packet content.

share|improve this answer
    
Hi Pawel, see my other answer below or have a look at the dump above. –  wlaus Mar 2 '11 at 22:21
    
@wlaus Hi, wlaus, I've fed your capture to Wireshark and it said "unknown options". :( –  Paweł Brodacki Mar 10 '11 at 17:54

Have seen this as well on several IDS's lately - 10000's of these directed at ports 80 & 443 from diverse sources - Myanmar, India, China... Definitely generated by the same software - always SYN, SEQ & ACK fields always identical. Weird. New exploit?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.