Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Background

During an incident on a small privative network (1 router/FW + 1 server) my server got accidentally exposed to the internet.

Fortunately it was protected by it's own UFW to allow only 1 specific traffic from a specific netrange and drop everything else on this interface.

Therefore, during the incident, it logged a lot of abnormal traffic which I've tried to categorize. I got :

  • Port scan (SYN only packets)
  • DNS scan (UDP to port 53)
  • DNS spoofing attempt (UDP from port 53 to port > 40000)

But I also got 1 pattern that I couldn't categorize ...

Question

  1. Am I right on my categorization ?
  2. Do you know what kind of traffic / attack attempt would trigger my firewall to log packet with the following specifications :
    • TCP only
    • Flags : ACK (90%) or ACK+PSH (10%)
    • Mostly comming from port 8888 (70%)
    • LEN=52 WINDOW=18 (50%) ; LEN <100 (90%) and WINDOW<=20 (90%)
    • wide range of destination port above 30000
share|improve this question
    
What were the source IP addresses? Did not you have connections open to port 8888 before the incident and for how long after the server exposition were the packets from 8888 coming? Also it could have been an ACK scan. –  pabouk Aug 20 '13 at 16:17
    
@pabouk Well It came from two netranges one from GB the other from southern asia. To my knowlege there was no allowed connexion on 8888 on the top router (and it was absoluetly not allowed on the server). These packets were recieved at a small rate during 6hrs. –  Cerber Aug 21 '13 at 20:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.