1

I am receiving constant traffic from an IP. I have checked web server logs and found nothing. I have used IP tables to close port 80 with no success.

Here is what I have extracted:

TCPDump after closing port 80: ... 16:29:58.352491 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 2165011454, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.354140 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1721916742, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.437774 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 363447977, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.524299 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 137986954, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.610422 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1651557377, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.695648 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1644752218, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.762889 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 708774106, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.781295 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1366521335, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.821036 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 1828494182, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.866077 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 858654160, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:58.957206 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 497033597, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 16:29:59.040977 IP elfmoney.ru.www > ME.DOMAIN.www: Flags [S], seq 698028417, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 ...

How can I find out more about what's going on?

3
  • What do your iptables rules look like?
    – mdadm
    Mar 29, 2014 at 16:37
  • Is this a synflood? Is this malicious?
    – T S
    Mar 29, 2014 at 17:09
  • Might be. Can you post the output of iptables -L -v ?
    – mdadm
    Mar 29, 2014 at 17:14

2 Answers 2

0
iptables -t raw -A PREROUTING -p all -j ACCEPT ;
iptables -t raw -I PREROUTING -s iptoblock -p all -j DROP ;
iptables -I INPUT 1 -s iptoblock -p all -j DROP ;

replace iptoblock with the IP address offending. Let me know if it works!

2
  • Unfortunately not. I can still see traffic from that IP!
    – T S
    Mar 29, 2014 at 16:56
  • 1
    normally that should do it. I guest but there is no other solution but you can ask your webhost if they can do it and deny it on their node.
    – Julio Fong
    Mar 29, 2014 at 17:01
0

You can find out if the source IP is being spoofed by allowing a SYN-ACK to be sent back in response to a few of the SYN packets. If the client replies to the SYN-ACK with a valid ACK packet, then the client IP is not spoofed.

If the client IP is spoofed there is not much more you can do.

If the client IP is real, you may be able to slow it down using LaBrea or similar tools.

There is no guarantee this will work though, if the sender of the packets ignores all replies you send back (which would be typical for a SYN flood), the best you can do is to use SYN cookies to ensure your service remains functional for legitimate users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .