Ping attacks...

[Dealt]

Sorry if a similar topic has been posted before but I searched the archives and found nothing to answer my query/problem.

Basically, recently I have been recieving notices from my firewall (PC-cillin) of Ping attacks and Netbios browsing warnings almost continuously whilst I am connected. I was wondering two things really, what is the impact of ping attacks on my connection and secondly what means of protection can I use.. like to mask my IP or other.

- Thanks alot -

[Cybr1d]

they could be just zombies scanning a network.

[Spyder32]

Well, for one:

1. What OS are you running?
2. What kind of connection do you have?

And do you have netBIOS file sharing turned on? Lemme know the detail's of these and I'll help ya out.

[MrLinus]

Basically, recently I have been recieving notices from my firewall (PC-cillin) of Ping attacks and Netbios browsing warnings almost continuously whilst I am connected. I was wondering two things really, what is the impact of ping attacks on my connection and secondly what means of protection can I use.. like to mask my IP or other.

A few things. How often are the pings attacks and do they happen in some sort of pattern (in groups or every so many per minute)? Evidentally, they aren't detrimental enough to prevent you from surfing the internet so the impact is minimal. As for NetBIOS there are a variety of worms and other beasties out there that will mimic or cause this. I wouldn't worry about it since your firewall seems to be stopping this.

As for masking your IP, it's not really a "doable" thing. Having a firewall and hardening your OS would be better things to look at. The NSA and SANS Reading Room have some guides on how to harden/lock down your system. You should also look in the Security Tutorials section here as there are some good tips and guides on similar topics.

[Dealt]

When I checked the log I also saw an attack called "Cloaking" could you explain this to me. The attacking IP was traced to amsterdam on every attack and their doesnt seem to be much correlation between the attack times however they are very frequent (20-30 per minute) I'll check out those security links. Thanks

[MrLinus]

When I checked the log I also saw an attack called "Cloaking" could you explain this to me.

Are you sure this is an attack? Because when I did a quick search on PC-cillin and "cloaking" I got this:

The Personal Firewall also offers a variety of functions that protects your system from hackers such as the cloaking option that prevents your computer from being found when connected to the internet. The Firewall also has three different levels of blocking from low to high because some programs require that certain ports on your computer are open.

What this leads me to believe is that you can turn off the ping feature (so your machine doesn't respond to ICMP requests and appears as "alive"). The only thing I can think of is that your machine is responding to the pings but getting no response back, which would mean either the attackers have ping turned off and/or are spoofing the source (hence, it's not in Amsterdam but perhaps really somewhere else).

[mrg81]

Hi,

I don't have much idea but this is what I found about cloaking:

When a search engine spider or human visitor requests a specific Web page, cloaking programs compare the IP address of the requesting party to a database of known IP addresses from specific search engine spiders. If the IP address matches one on the list, it serves a particular page that was specifically written for the search engines to the spider. This page is normally optimized to rank well for that particular search engine, in order to achieve high visibility.

On the other hand, if that IP address does not match one in the database's list, the requesting entity is "assumed" to be a human visitor and is served the actual "real" page or is simply re-directed to another page appropriate for human visitors (!).

More info on: http://www.rankforsales.com/always-avoid-cloaking.html

How ver I still don't understand How is cloaking affecting him ?

MRG

[nihil]

If it is any comfort, up until around 18 months ago I would have the warnings turned on............I had to turn them off!

For example I had 1,207 hits on my last session...............it is normal, just look at the logs and see if you are getting hit from exactly the same IP address multiple times..........then you might consider using their ISP abuse reporting system.

Otherwise don't worry, it seems normal these days, just be sure to keep your software up to date and scan regularly for nasties.

Good luck

[SirDice]

Originally posted here by Dealt
Basically, recently I have been recieving notices from my firewall (PC-cillin) of Ping attacks and Netbios browsing warnings almost continuously whilst I am connected. I was wondering two things really, what is the impact of ping attacks on my connection and secondly what means of protection can I use.. like to mask my IP or other.

It's a side effect of all the viruses running rampant on the Internet.
As for protecting yourself against it, you're allready doing it by running a firewall.