From owner-freebsd-security@FreeBSD.ORG  Mon Jun  7 06:10:51 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E0A3816A4CE
	for <freebsd-security@freebsd.org>;
	Mon,  7 Jun 2004 06:10:51 +0000 (GMT)
Received: from Neo-Vortex.Ath.Cx (203-217-84-45.dyn.iinet.net.au
	[203.217.84.45])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2096D43D1D
	for <freebsd-security@freebsd.org>;
	Mon,  7 Jun 2004 06:10:50 +0000 (GMT)
	(envelope-from root@Neo-Vortex.Ath.Cx)
Received: from localhost.Neo-Vortex.got-root.cc
	(Neo-Vortex@localhost.Neo-Vortex.got-root.cc [127.0.0.1])
	by Neo-Vortex.Ath.Cx (8.12.10/8.12.10) with ESMTP id i576AkBQ047126;
	Mon, 7 Jun 2004 16:10:47 +1000 (EST)
	(envelope-from root@Neo-Vortex.Ath.Cx)
Date: Mon, 7 Jun 2004 16:10:46 +1000 (EST)
From: Neo-Vortex <root@Neo-Vortex.Ath.Cx>
To: Michael Vlasov <mv@rbr.ru>
In-Reply-To: <opr87mhdtds10hlf@mv.rbr.ru>
Message-ID: <20040607160728.A47101@Neo-Vortex.Ath.Cx>
References: <20040529190052.25D1916A4CF@hub.freebsd.org>
	<opr87mhdtds10hlf@mv.rbr.ru>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: freebsd-security@freebsd.org
Subject: Re: freebsd-security Digest, Vol 61, Issue 3
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Jun 2004 06:10:52 -0000



On Mon, 7 Jun 2004, Michael Vlasov wrote:

> On Sat, 29 May 2004 12:00:52 -0700 (PDT),
> <freebsd-security-request@freebsd.org> wrote:
>
> Hello !
>
> Today i see in snort logs :
>
> [**] [1:528:4] BAD-TRAFFIC loopback traffic [**]
> [Classification: Potentially Bad Traffic] [Priority: 2]
> 06/07-09:44:39.044590 127.0.0.1:80 -> 10.6.148.173:1566
> TCP TTL:128 TOS:0x0 ID:577 IpLen:20 DgmLen:40
> ***A*R** Seq: 0x0  Ack: 0x75830001  Win: 0x0  TcpLen: 20
> [Xref => http://rr.sans.org/firewall/egress.php]
>
> [**] [1:528:4] BAD-TRAFFIC loopback traffic [**]
> [Classification: Potentially Bad Traffic] [Priority: 2]
> 06/07-09:44:39.075824 127.0.0.1:80 -> 10.6.249.83:1299
> TCP TTL:128 TOS:0x0 ID:578 IpLen:20 DgmLen:40
> ***A*R** Seq: 0x0  Ack: 0x568A0001  Win: 0x0  TcpLen: 20
> [Xref => http://rr.sans.org/firewall/egress.php]
>
> [**] [1:528:4] BAD-TRAFFIC loopback traffic [**]
> [Classification: Potentially Bad Traffic] [Priority: 2]
> 06/07-09:44:39.107072 127.0.0.1:80 -> 10.6.96.121:1032
> TCP TTL:128 TOS:0x0 ID:579 IpLen:20 DgmLen:40
> ***A*R** Seq: 0x0  Ack: 0x37920001  Win: 0x0  TcpLen: 20
> [Xref => http://rr.sans.org/firewall/egress.php]
>
> Why ? ;-)

Ok, that means that someone (or thing) is spoofing packets to your box
(i know, and so does snort, that its spoofed because the source ip is
127.0.0.1 and its coming in on an interface apart from lo0) this is
sometimes used as a DoS attack (its one of those fun addresses to use as
source addresses for them), although, by the looks of it (because theres
multiple dst-ports being used), someone is using a program like nmap to
portscan your host using a spoofed ip

~Neo-Vortex