0

Good Evening.

Today I noticed a strange flood on a box that I am working with, here is a dump from tcpdump:

23:21:07.580917 IP (tos 0x0, ttl 64, id 5746, offset 0, flags [DF], proto TCP (6), length 94) f125.wedos.net.microsoft-ds > kryton.progresive.cz.57250: Flags [P.], cksum 0xbe27 (correct), seq 3455992339:3455992381, ack 1572183034, win 23577, options [nop,nop,TS val 782520278 ecr 604343104], length 42SMB PACKET: SMBecho (REPLY)
23:21:07.718300 IP (tos 0x0, ttl 64, id 45880, offset 0, flags [DF], proto TCP (6), length 216) f125.wedos.net.microsoft-ds > gin.adminsite.cz.47263: Flags [P.], cksum 0xa55d (correct), seq 967:1131, ack 1483, win 15597, options [nop,nop,TS val 782520417 ecr 743201370], length 164SMB PACKET: SMBtrans2 (REPLY)
23:21:07.720359 IP (tos 0x0, ttl 64, id 45881, offset 0, flags [DF], proto TCP (6), length 216) f125.wedos.net.microsoft-ds > gin.adminsite.cz.47263: Flags [P.], cksum 0x5ee0 (correct), seq 1131:1295, ack 1605, win 15597, options [nop,nop,TS val 782520418 ecr 743201371], length 164SMB PACKET: SMBtrans2 (REPLY)
23:21:07.720932 IP (tos 0x0, ttl 64, id 45882, offset 0, flags [DF], proto TCP (6), length 91) f125.wedos.net.microsoft-ds > gin.adminsite.cz.47263: Flags [P.], cksum 0xdc2e (correct), seq 1295:1334, ack 1733, win 15597, options [nop,nop,TS val 782520419 ecr 743201373], length 39SMB PACKET: SMBtrans2 (REPLY)

Peaking at around 250 of these packets per second ("only" ~10mbit/s, but still annoying).

f125.wedos.net is not my hostname, but instead, a host on a different subnet from my provider. The target address is a random address on on of the subnets from my provider.

The Box is running Debian 7.7, a fresh install with no major modifications and no other services / daemons running.

How can I prevent this from happening? Should I just talk to the technicians at my datacenter about it?

Thank you.

  • If neither of those machines are on the same subnet as you, you shouldn't be seeing this traffic at all. And even if one was, you still shouldn't be seeing it unless the switch has gone out to lunch. It's time to have a long chat with your datacenter NOC. – Michael Hampton Jan 15 '15 at 1:20
0

How can I prevent this from happening?

you can rate limit:

iptables -I INPUT -p tcp --dport 445 -i eth0 -m state --state NEW -m recent --set

iptables -I INPUT -p tcp --dport 445 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

or just drop altogether / filter on your subnet on incoming tcp/445 if you need samba services.... that port is usually windoze attck.

  • Thank you for your input, but somehow these rules never kick in, probably just some switch that has died and is now causing trouble, I will have a talk with my NOC. – David Bernard Jan 15 '15 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.