From owner-freebsd-net@FreeBSD.ORG  Wed Feb 25 06:19:51 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1BD8816A4CE
	for <freebsd-net@freebsd.org>; Wed, 25 Feb 2004 06:19:51 -0800 (PST)
Received: from mail.otel.net (gw3.OTEL.net [212.36.8.151])
	by mx1.FreeBSD.org (Postfix) with ESMTP id CAD8543D2D
	for <freebsd-net@freebsd.org>; Wed, 25 Feb 2004 06:19:50 -0800 (PST)
	(envelope-from tbyte@OTEL.net)
Received: from dragon.otel.net ([212.36.8.135] helo=OTEL.net)
	by mail.otel.net with esmtp (Exim 4.30; FreeBSD)
	id 1Avzt7-000Dat-60; Wed, 25 Feb 2004 16:19:49 +0200
Message-ID: <403CAF07.5040906@OTEL.net>
Date: Wed, 25 Feb 2004 16:19:51 +0200
From: Iasen Kostov <tbyte@OTEL.net>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko/20040224
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Gleb Smirnoff <glebius@cell.sick.ru>
References: <200402242315.i1ONFbmZ028103@soth.ventu>
	<403C9705.3060108@OTEL.net> <10324604148.20040225164703@b-o.ru>
	<20040225141642.GB86194@cell.sick.ru>
In-Reply-To: <20040225141642.GB86194@cell.sick.ru>
Content-Type: text/plain; charset=KOI8-R; format=flowed
Content-Transfer-Encoding: 7bit
cc: freebsd-net@freebsd.org
Subject: Re: Bad loopback traffic not stopped by ipfw.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Feb 2004 14:19:51 -0000

Gleb Smirnoff wrote:

>On Wed, Feb 25, 2004 at 04:47:03PM +0300, Andrew Riabtsev wrote:
>A> To me it would be also interesting to know where this traffic comes
>A> from. I have same on my local net:
>A> 
>A> # tcpdump -neifxp0 src or dst 127.0.0.1
>A> tcpdump: listening on fxp0
>A> 16:26:23.280737 0:50:fc:ed:d4:4 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.141.148.1928: R 0:0(0) ack 1986723841 win 0
>  
>
>>16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0
>>    
>>
>
>This is some kind of Win32 virus. This floods can be easily
>stopped by ipfw rule:
>
>deny tcp from any to any tcpflags rst,ack
>
>  
>
    These packets never reach IPFW as we can see.