During an incident on a small privative network (1 router/FW + 1 server) my server got accidentally exposed to the internet.
Fortunately it was protected by it's own UFW to allow only 1 specific traffic from a specific netrange and drop everything else on this interface.
Therefore, during the incident, it logged a lot of abnormal traffic which I've tried to categorize. I got :
- Port scan (
- DNS scan (UDP to port 53)
- DNS spoofing attempt (UDP from port 53 to port > 40000)
But I also got 1 pattern that I couldn't categorize ...
- Am I right on my categorization ?
- Do you know what kind of traffic / attack attempt would trigger my firewall to log packet with the following specifications :
- Flags :
- Mostly comming from
LEN=52 WINDOW=18(50%) ;
LEN <100(90%) and
- wide range of destination port above 30000