I've set up psad 2.1.5-3 in Ubuntu 10.10. I keep receiving emails like this
=-=-=-=-=-=-=-=-=-=-=-= Wed Oct 19 17:26:57 2011 =-=-=-=-=-=-=-=-=-=-=-=
Danger level: [4] (out of 5)
Scanned UDP ports: [17500: 1 packets, Nmap: -sU]
iptables chain: INPUT, 1 packets
Source: XXX.XXX.215.132
DNS: [No reverse dns info available]
Destination: 255.255.255.255
DNS: [No reverse dns info available]
Overall scan start: Mon Oct 17 12:14:31 2011
Total email alerts: 2256
Complete UDP range: [67-17500]
Syslog hostname: XXXX
Global stats: chain: interface: TCP: UDP: ICMP:
INPUT eth0 0 4544 0
[+] Whois Information:
% [whois.apnic.net node-5]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 150.0.0.0 - 150.255.255.255
netname: ERX-NETBLOCK
descr: Early registration addresses
remarks: ------------------------------------------------------
remarks: Important:
remarks:
remarks: Networks in this range were allocated by InterNIC
remarks: prior to the formation of Regional Internet
remarks: Registries (RIRs): AfriNIC, APNIC, ARIN, LACNIC and RIPE NCC.
remarks:
remarks: Address ranges from this historical space have now
remarks: been transferred to the appropriate RIR database.remarks:
remarks: If your search has returned this record, it means the
remarks: address range is not administered by APNIC.
remarks:
remarks: Instead, please search one of the following databases:
remarks:
remarks: - AfriNIC (Africa)
remarks: website: http://www.afrinic.net/
remarks: command line: whois.afrinic.net
remarks:
remarks: - ARIN (Northern America)
remarks: website: http://www.arin.net/
remarks: command line: whois.arin.net
remarks:
remarks: - LACNIC (Latin America and the Carribean)
remarks: website: http://www.lacnic.net/
remarks: command line: whois.lacnic.net
remarks:
remarks: - RIPE NCC (Europe)
remarks: website: http://www.ripe.net/
remarks: command line: whois.ripe.net
remarks:
remarks: For information on the Early Registration Transfer
remarks: (ERX) project, see:
remarks:
remarks: http://www.apnic.net/db/erx
remarks:
remarks: ------------------------------------------------------
country: AU
admin-c: IANA1-AP
tech-c: IANA1-AP
mnt-by: APNIC-HM
mnt-lower: APNIC-HM
status: ALLOCATED PORTABLE
changed: hm-changed@apnic.net 20030404
changed: hm-changed@apnic.net 20040926
changed: hm-changed@apnic.net 20070214
source: APNIC
role: Internet Assigned Numbers Authority
address: see http://www.iana.org.
country:
phone:
e-mail: nobody@apnic.net
admin-c: IANA1-AP
tech-c: IANA1-AP
nic-hdl: IANA1-AP
remarks: For more information on IANA services
remarks: go to IANA web site at http://www.iana.org.
mnt-by: MAINT-APNIC-AP
changed: helpdesk@apnic.net 20110811
source: APNIC
=-=-=-=-=-=-=-=-=-=-=-= Wed Oct 19 17:26:57 2011 =-=-=-=-=-=-=-=-=-=-=-=
My ip is XXX.XXX.215.84, and attacker (?) is XXX.XXX.215.132 Also, according to mail destination of the attack is 255.255.255.255 or XXX.XXX.215.255, which is a broadcast address.
Any ideas of what is going on? Is this host actually an attacker? Or psad triggers a false alarm?
