Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've just recently noticed an IP address that has been showing up in our SonicWall logs on a pretty frequent basis. Throughout the course of an average day, we'll see around 100 dropped packets originating from 17.10.13.204, which is in a block of IPs registered to Apple. Here's a sample:

Apr 26 12:59:47 id=firewall sn=0017C5107A2C time="2011-04-26 12:59:47" fw=X.X.X.Y pri=1 c=32 m=179 msg="Probable TCP NULL scan detected" n=0 src=17.10.13.204:48225:X1 dst=X.X.X.Z:80 note="TCP Flag(s): None"

I'm not too concerned -- it's just a TCP NULL scan, and they are only hitting specifically port 80 on just a few of our many IP addresses. That said, I'm still quite curious what the heck is going on :)

I did a little googling WRT that IP address, and didn't find much more than other people's log files and such. Only one post seemed to stand out, but it was a couple months old and hadn't gained much traction.

Anyone else seeing TCP NULL scans from these guys? I'm not sure how long this has been going on, as I only have a couple months of logs archived. I'd be curious to know if this is a fairly recent thing, or if it's been happening for a while.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted
shell$ host 17.10.13.204
       204.13.10.17.in-addr.arpa domain name pointer spoofed-src-frm-outside-apple.apple.com
share|improve this answer
    
So, apparently Apple is aware that someone has been spoofing packets and using this IP address as the source, and they've set the PTR record for that IP to reflect that. Now I can only speculate as to why anyone would be doing this. It almost seems as if someone is attempting to DDoS Apple, by flooding them with backscatter. –  walkeran Apr 27 '11 at 18:44
add comment

This has been ongoing for months. I reported this traffic to Apple back in November 2010 and I'm still seeing it. I don't think this is a DoS because it would be too simple to stop on Apple's end. All they would have to do is block the RST packets to their IP or just block any packets incoming to that IP at all. The IP has been the same since it started. I've blocked it at our edge routing layer but I'm still logging the drop so I can confirm its still ongoing.

Best way to figure this out is to get the ISP involved and start tracing this traffic back to its source. I'm thinking this is a misconfiguration of some type.

share|improve this answer
    
Thanks for debunking the idea (or at least providing a worthy explanation as to why it's unlikely) that this is an attempt at a DoS. I can see how this is an issue that would cause various people to point the finger at someone else, so I'll likely just deal with the fact that this will probably be ongoing until someone with a voice louder than mine speaks up :D –  walkeran Apr 28 '11 at 16:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.