Date: Wed, 17 Oct 2001 07:58:19 +0200 From: Emre Bastuz <info@emre.de> To: freebsd-security@freebsd.org Subject: DoS ? Limiting closed port RST response ? Message-ID: <3BCD1DFB.2030103@emre.de>
next in thread | raw e-mail | index | archive | help
Hi, just this morning I have noticed the following messages in my /var/log/messages that somehow make me nervous: Oct 16 20:55:53 MyHost inetd[5492]: warning: can't get client address: Connection reset by peer Oct 16 20:55:53 MyHost inetd[5493]: warning: can't get client address: Connection reset by peer Oct 16 20:55:53 MyHost inetd[5493]: refused connection from unknown, service imapd (tcp) Oct 16 20:55:53 MyHost inetd[5493]: refused connection from unknown, service imapd (tcp) Oct 16 20:55:53 MyHost inetd[5492]: refused connection from unknown, service teapop (tcp) Oct 16 20:55:53 MyHost inetd[5492]: refused connection from unknown, service teapop (tcp) Oct 16 20:55:54 MyHost /kernel: Limiting closed port RST response from 371 to 200 packets per second Oct 16 20:55:54 MyHost inetd[5494]: warning: can't get client address: Connection reset by peer Oct 16 20:55:54 MyHost inetd[5494]: refused connection from unknown, service ftpd (tcp) Oct 16 20:55:54 MyHost inetd[5494]: refused connection from unknown, service ftpd (tcp) Oct 16 20:55:54 MyHost mysqld[375]: warning: can't get client address: Connection reset by peer Oct 16 20:55:54 MyHost mysqld[375]: warning: can't get client address: Connection reset by peer Oct 16 20:55:54 MyHost mysqld[375]: refused connect from unknown Oct 16 20:55:54 MyHost mysqld[375]: refused connect from unknown Oct 16 20:56:24 MyHost /kernel: Limiting closed port RST response from 480 to 200 packets per second [... goes on like this for a *lot* of lines ...] These messages are repeated several times. It seems that somebody is trying to contact a certain service twice and then causing the "RST" messages, then again trying another service twice, etc.. Iīve checked some websites and found out that the RST messages can be caused by portscans which would make sense somehow. What I donīt get is, why canīt I see any IP addresses as source of the portscans ? Even if this is some kind of DoS Attack thing where the source IP is spoofed (the victimīs IP) I should see it in the log, right ? My system is a FreeBSD 4.3-RELEASE running Snort Version 1.8.1-RELEASE (Build 74). In case this was an attack Iīm wondering why Snort did not detect it. Anyway, any help finding out whatīs going on with my box will be appreciated. Regards, Emre -- Emre Bastuz info@emre.de http://www.emre.de UIN: 561260 PGP Key ID: 0xEA0E2CA1 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3BCD1DFB.2030103>