Date: Wed, 25 Feb 2004 17:21:34 +0300 From: Gleb Smirnoff <glebius@cell.sick.ru> To: Iasen Kostov <tbyte@OTEL.net> Cc: freebsd-net@freebsd.org Subject: Re: Bad loopback traffic not stopped by ipfw. Message-ID: <20040225142134.GA86436@cell.sick.ru> In-Reply-To: <403CAF07.5040906@OTEL.net> References: <200402242315.i1ONFbmZ028103@soth.ventu> <403C9705.3060108@OTEL.net> <10324604148.20040225164703@b-o.ru> <20040225141642.GB86194@cell.sick.ru> <403CAF07.5040906@OTEL.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Feb 25, 2004 at 04:19:51PM +0200, Iasen Kostov wrote: I> >>16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > I> >>192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0 I> > I> >This is some kind of Win32 virus. This floods can be easily I> >stopped by ipfw rule: I> > I> >deny tcp from any to any tcpflags rst,ack I> > I> > I> > I> These packets never reach IPFW as we can see. Ughu. Really. But I have millions of them from non-localhost addresses. P.S. This is really off-topic already. We should move to -isp@ may be. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040225142134.GA86436>