From owner-freebsd-net@FreeBSD.ORG  Fri Feb 27 07:14:31 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D7A8A16A4CE
	for <freebsd-net@freebsd.org>; Fri, 27 Feb 2004 07:14:31 -0800 (PST)
Received: from mail001.syd.optusnet.com.au (mail001.syd.optusnet.com.au
	[211.29.132.142])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AC64C43D1D
	for <freebsd-net@freebsd.org>; Fri, 27 Feb 2004 07:14:30 -0800 (PST)
	(envelope-from tfrank@optushome.com.au)
Received: from marvin.home.local (c211-28-241-189.eburwd5.vic.optusnet.com.au
	[211.28.241.189])i1RFE5h28248;	Sat, 28 Feb 2004 02:14:07 +1100
Received: by marvin.home.local (Postfix, from userid 1001)
	id 62DF83DE; Sat, 28 Feb 2004 02:14:05 +1100 (EST)
Date: Sat, 28 Feb 2004 02:14:05 +1100
From: Tony Frank <tfrank@optushome.com.au>
To: Gleb Smirnoff <glebius@cell.sick.ru>,
	Iasen Kostov <tbyte@OTEL.net>, freebsd-net@freebsd.org
Message-ID: <20040227151405.GA5540@marvin.home.local>
References: <200402242315.i1ONFbmZ028103@soth.ventu>
	<403C9705.3060108@OTEL.net> <10324604148.20040225164703@b-o.ru>
	<20040225141642.GB86194@cell.sick.ru> <403CAF07.5040906@OTEL.net>
	<20040225142134.GA86436@cell.sick.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20040225142134.GA86436@cell.sick.ru>
User-Agent: Mutt/1.4.2.1i
Subject: Re: Bad loopback traffic not stopped by ipfw.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Feb 2004 15:14:32 -0000

Hi all,

On Wed, Feb 25, 2004 at 05:21:34PM +0300, Gleb Smirnoff wrote:
> On Wed, Feb 25, 2004 at 04:19:51PM +0200, Iasen Kostov wrote:
> I> >>16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 
> I> >>192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0
> I> >
> I> >This is some kind of Win32 virus. This floods can be easily
> I> >stopped by ipfw rule:
> I> >
> I> >deny tcp from any to any tcpflags rst,ack
> I> >
> I>    These packets never reach IPFW as we can see.
> 
> Ughu. Really.
> But I have millions of them from non-localhost addresses.
> 

This maybe is of interest?

http://www.dshield.org/pipermail/list/2004-January/014027.php

Regards,

Tony