Firewall log forensics

Tigershark had a thread earlier today about some unusual activity, and I didn't have time to reply....I can't find the thread anymore.... :shrug:

I found a few links for the newer members (myself included) that will hopefully help to explain a little about what is going on with the logs.

http://www.robertgraham.com/pubs/firewall-seen.html

http://www.counterpane.com/log-analysis.html

http://navigators.com/firewall.html

And for a little help understanding terms with which we may not be familiar..

http://www.webopedia.com/

If somebody already posted these, please accept my apologies, I hadn't seen them here yet.

Yeah on my Zone Alarm Usually the most command activity I get is A TCP Packet(Flag:S) The S flag means "Syn" Which is a connection request. I also get ICMP(Type:8) which is a ICMP echo request.

Limpster, your ICMP(Type:8) , also known as and isolated pings is mostlikely a Welchia or Msblaster trying to contact you from someone's computer in your area.

The only thing on my log recently is an incoming UDP from 10.18.200.1, type 67, trying to resolve itself a 255.255.255.255:68. I haven't figured out what that is from yet, but it just started yesterday, and had been hitting about every 10 minutes.

My spy detectors are not picking up anything, nor is my antivirus. Anybody have any ideas what that may be?

Cheers!

groovicus, that would be the bootp protocol passing on to your machine your DHCP info...

Thank you SoggyBottom. Ok, it's the boot protocol, I understand that. What I'm failing to understand (big surprise :) ) is why from that location? My IP is not even close to that range. Judging by your response though, it's nothing I should pay attention to.

groovicus: bootp will use the broadcast address if it doesn't know its correct address.
The broadcast address is 255.255.255.255

Quote:

---

3. Packet Format

All numbers shown are decimal, unless indicated otherwise. The BOOTP
packet is enclosed in a standard IP [8] UDP [7] datagram. For
simplicity it is assumed that the BOOTP packet is never fragmented.
Any numeric fields shown are packed in 'standard network byte order',
i.e. high order bits are sent first.

In the IP header of a bootrequest, the client fills in its own IP
source address if known, otherwise zero. When the server address is
unknown, the IP destination address will be the 'broadcast address'
255.255.255.255. This address means 'broadcast on the local cable,
(I don't know my net number)' [4].

---

ftp://ftp.rfc-editor.org/in-notes/rfc951.txt


http://www.rfc-editor.org/rfcsearch.html

search for bootp for more info