 | | | hacked.e-microsoft.net attacks!!! | hacked.e-microsoft.net attacks!!! 2005-09-10 - By Opesh Alkara
Back
Hi Group,
I run RHEL ES 3.0, kernel 2.4.21-27.0.1.EL with IPtables as firewall....
I am getting some strange attacks on my gateway-firewall...here is the scrap
of the tcpdump command that displays the traffic transaction on my
gateway/firewall:
[root@(protected) root]# tcpdump -i eth0 | grep microsoft
tcpdump: listening on eth0
14:45:46.636128 188.26.25.111.1796 > hacked.e-microsoft.net.http: S
1395392512:1395392512(0) win 16384
14:45:47.136837 188.26.25.112.1217 > hacked.e-microsoft.net.http: S
40173568:40173568(0) win 16384
14:45:47.637597 188.26.25.113.1271 > hacked.e-microsoft.net.http: S
2122645504:2122645504(0) win 16384
14:45:48.138274 188.26.25.114.1623 > hacked.e-microsoft.net.http: S
1886519296:1886519296(0) win 16384
14:45:48.639106 188.26.25.115.1713 > hacked.e-microsoft.net.http: S
536215552:536215552(0) win 16384
14:45:49.139757 188.26.25.116.1541 > hacked.e-microsoft.net.http: S
1795227648:1795227648(0) win 16384
14:45:49.640460 188.26.25.117.1286 > hacked.e-microsoft.net.http: S
931528704:931528704(0) win 16384
14:46:24.414942 192.168.2.124.1060 > 65.53.141.93.microsoft-ds: S
2943232226:2943232226(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
14:47:06.524061 192.168.2.124.1063 > 65.53.141.93.microsoft-ds: S
1414470707:1414470707(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
14:47:18.559278 192.168.2.124.1065 > 65.53.192.13.microsoft-ds: S
3528415518:3528415518(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
14:48:19.849458 188.26.20.195.1041 > hacked.e-microsoft.net.http: S
415105024:415105024(0) win 16384
14:48:20.346990 188.26.20.196.1474 > hacked.e-microsoft.net.http: S
1030488064:1030488064(0) win 16384
14:48:22.349682 188.26.20.200.1491 > hacked.e-microsoft.net.http: S
782630912:782630912(0) win 16384
14:48:23.351150 188.26.20.202.1590 > hacked.e-microsoft.net.http: S
10027008:10027008(0) win 16384
14:48:24.352641 188.26.20.204.1698 > hacked.e-microsoft.net.http: S
1303838720:1303838720(0) win 16384
14:48:24.853235 188.26.20.205.1442 > hacked.e-microsoft.net.http: S
968032256:968032256(0) win 16384
14:48:25.354003 188.26.20.206.1527 > hacked.e-microsoft.net.http: S
1304952832:1304952832(0) win 16384
14:48:25.854672 188.26.20.207.1642 > hacked.e-microsoft.net.http: S
1116405760:1116405760(0) win 16384
14:48:46.386855 188.26.20.248.1654 > hacked.e-microsoft.net.http: S
416743424:416743424(0) win 16384
14:48:55.907746 188.26.21.11.1192 > hacked.e-microsoft.net.http: S
202702848:202702848(0) win 16384
14:48:56.909174 188.26.21.13.1285 > hacked.e-microsoft.net.http: S
488112128:488112128(0) win 16384
14:49:10.438591 188.26.21.40.1664 > hacked.e-microsoft.net.http: S
691732480:691732480(0) win 16384
14:49:11.440020 188.26.21.42.1503 > hacked.e-microsoft.net.http: S
1183580160:1183580160(0) win 16384
14:49:13.943673 188.26.21.47.1193 > hacked.e-microsoft.net.http: S
216072192:216072192(0) win 16384
14:49:19.451578 188.26.21.58.1202 > hacked.e-microsoft.net.http: S
141623296:141623296(0) win 16384
42561 packets received by filter
32611 packets dropped by kernel
Could anyone please tell whats going on my network...of if anyone has
experienced the same attack....as such I did't find any thing on google
regarding this....
Thanks for efforts.....
Regards
Oopss..
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@(protected)?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
Earn $52 per hosting referral at Lunarpages.
|
|
|