From owner-freebsd-net@FreeBSD.ORG  Wed Feb 25 06:21:37 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1DE7B16A4CE
	for <freebsd-net@freebsd.org>; Wed, 25 Feb 2004 06:21:37 -0800 (PST)
Received: from cell.sick.ru (cell.sick.ru [217.72.144.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4D7B343D1D
	for <freebsd-net@freebsd.org>; Wed, 25 Feb 2004 06:21:36 -0800 (PST)
	(envelope-from glebius@cell.sick.ru)
Received: from cell.sick.ru (glebius@localhost [127.0.0.1])
	by cell.sick.ru (8.12.9/8.12.8) with ESMTP id i1PELYQE086454
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Wed, 25 Feb 2004 17:21:35 +0300 (MSK)
	(envelope-from glebius@cell.sick.ru)
Received: (from glebius@localhost)
	by cell.sick.ru (8.12.9/8.12.6/Submit) id i1PELYHt086453;
	Wed, 25 Feb 2004 17:21:34 +0300 (MSK)
Date: Wed, 25 Feb 2004 17:21:34 +0300
From: Gleb Smirnoff <glebius@cell.sick.ru>
To: Iasen Kostov <tbyte@OTEL.net>
Message-ID: <20040225142134.GA86436@cell.sick.ru>
Mail-Followup-To: Gleb Smirnoff <glebius@cell.sick.ru>,
	Iasen Kostov <tbyte@OTEL.net>, freebsd-net@freebsd.org
References: <200402242315.i1ONFbmZ028103@soth.ventu>
	<403C9705.3060108@OTEL.net> <10324604148.20040225164703@b-o.ru>
	<20040225141642.GB86194@cell.sick.ru> <403CAF07.5040906@OTEL.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <403CAF07.5040906@OTEL.net>
User-Agent: Mutt/1.5.6i
cc: freebsd-net@freebsd.org
Subject: Re: Bad loopback traffic not stopped by ipfw.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Feb 2004 14:21:37 -0000

On Wed, Feb 25, 2004 at 04:19:51PM +0200, Iasen Kostov wrote:
I> >>16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 
I> >>192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0
I> >
I> >This is some kind of Win32 virus. This floods can be easily
I> >stopped by ipfw rule:
I> >
I> >deny tcp from any to any tcpflags rst,ack
I> >
I> > 
I> >
I>    These packets never reach IPFW as we can see.

Ughu. Really.
But I have millions of them from non-localhost addresses.

P.S. This is really off-topic already. We should move to -isp@ may be.

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE