From owner-freebsd-net@FreeBSD.ORG  Wed Feb 25 06:16:45 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AD91216A4CE
	for <freebsd-net@freebsd.org>; Wed, 25 Feb 2004 06:16:45 -0800 (PST)
Received: from cell.sick.ru (cell.sick.ru [217.72.144.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP id DEE9043D1D
	for <freebsd-net@freebsd.org>; Wed, 25 Feb 2004 06:16:44 -0800 (PST)
	(envelope-from glebius@cell.sick.ru)
Received: from cell.sick.ru (glebius@localhost [127.0.0.1])
	by cell.sick.ru (8.12.9/8.12.8) with ESMTP id i1PEGgQE086380
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Wed, 25 Feb 2004 17:16:43 +0300 (MSK)
	(envelope-from glebius@cell.sick.ru)
Received: (from glebius@localhost)
	by cell.sick.ru (8.12.9/8.12.6/Submit) id i1PEGgW2086379;
	Wed, 25 Feb 2004 17:16:42 +0300 (MSK)
Date: Wed, 25 Feb 2004 17:16:42 +0300
From: Gleb Smirnoff <glebius@cell.sick.ru>
To: Andrew Riabtsev <resident@b-o.ru>
Message-ID: <20040225141642.GB86194@cell.sick.ru>
Mail-Followup-To: Gleb Smirnoff <glebius@cell.sick.ru>,
	Andrew Riabtsev <resident@b-o.ru>, Iasen Kostov <tbyte@OTEL.net>,
	freebsd-net@freebsd.org
References: <200402242315.i1ONFbmZ028103@soth.ventu>
	<403C9705.3060108@OTEL.net> <10324604148.20040225164703@b-o.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <10324604148.20040225164703@b-o.ru>
User-Agent: Mutt/1.5.6i
cc: Iasen Kostov <tbyte@OTEL.net>
cc: freebsd-net@freebsd.org
Subject: Re: Bad loopback traffic not stopped by ipfw.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Feb 2004 14:16:45 -0000

On Wed, Feb 25, 2004 at 04:47:03PM +0300, Andrew Riabtsev wrote:
A> To me it would be also interesting to know where this traffic comes
A> from. I have same on my local net:
A> 
A> # tcpdump -neifxp0 src or dst 127.0.0.1
A> tcpdump: listening on fxp0
A> 16:26:23.280737 0:50:fc:ed:d4:4 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.141.148.1928: R 0:0(0) ack 1986723841 win 0
> 16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0

This is some kind of Win32 virus. This floods can be easily
stopped by ipfw rule:

deny tcp from any to any tcpflags rst,ack

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE