2

I've just recently noticed an IP address that has been showing up in our SonicWall logs on a pretty frequent basis. Throughout the course of an average day, we'll see around 100 dropped packets originating from 17.10.13.204, which is in a block of IPs registered to Apple. Here's a sample:

Apr 26 12:59:47 id=firewall sn=0017C5107A2C time="2011-04-26 12:59:47" fw=X.X.X.Y pri=1 c=32 m=179 msg="Probable TCP NULL scan detected" n=0 src=17.10.13.204:48225:X1 dst=X.X.X.Z:80 note="TCP Flag(s): None"

I'm not too concerned -- it's just a TCP NULL scan, and they are only hitting specifically port 80 on just a few of our many IP addresses. That said, I'm still quite curious what the heck is going on :)

I did a little googling WRT that IP address, and didn't find much more than other people's log files and such. Only one post seemed to stand out, but it was a couple months old and hadn't gained much traction.

Anyone else seeing TCP NULL scans from these guys? I'm not sure how long this has been going on, as I only have a couple months of logs archived. I'd be curious to know if this is a fairly recent thing, or if it's been happening for a while.

Improve this question

2 Answers 2

Reset to default
2 
shell$ host 17.10.13.204
       204.13.10.17.in-addr.arpa domain name pointer spoofed-src-frm-outside-apple.apple.com
Improve this answer
1
  • So, apparently Apple is aware that someone has been spoofing packets and using this IP address as the source, and they've set the PTR record for that IP to reflect that. Now I can only speculate as to why anyone would be doing this. It almost seems as if someone is attempting to DDoS Apple, by flooding them with backscatter.
    – walkeran
    Apr 27, 2011 at 18:44
1

This has been ongoing for months. I reported this traffic to Apple back in November 2010 and I'm still seeing it. I don't think this is a DoS because it would be too simple to stop on Apple's end. All they would have to do is block the RST packets to their IP or just block any packets incoming to that IP at all. The IP has been the same since it started. I've blocked it at our edge routing layer but I'm still logging the drop so I can confirm its still ongoing.

Best way to figure this out is to get the ISP involved and start tracing this traffic back to its source. I'm thinking this is a misconfiguration of some type.

Improve this answer
1
  • Thanks for debunking the idea (or at least providing a worthy explanation as to why it's unlikely) that this is an attempt at a DoS. I can see how this is an issue that would cause various people to point the finger at someone else, so I'll likely just deal with the fact that this will probably be ongoing until someone with a voice louder than mine speaks up :D
    – walkeran
    Apr 28, 2011 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .