????? Something new ??????

I'm sat here, minding my own business, just outside Detroit..... Having watched tha Lions beat my Raiders..... :mad: , and I take a look at my firewall..... It's filled with the following:-

FWIN,2003/11/02,16:28:18 -5:00 GMT,200.244.8.49:2074,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:18 -5:00 GMT,12.219.154.217:3966,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:20 -5:00 GMT,203.106.59.148:3048,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:26 -5:00 GMT,193.170.2.89:4481,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:42 -5:00 GMT,207.28.191.115:1104,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:44 -5:00 GMT,24.27.111.49:62183,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:46 -5:00 GMT,202.8.253.213:1773,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:46 -5:00 GMT,24.27.111.49:62184,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:46 -5:00 GMT,66.156.21.163:32969,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:48 -5:00 GMT,212.160.133.5:4324,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:28:48 -5:00 GMT,24.27.111.49:62185,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:29:12 -5:00 GMT,193.170.2.89:4500,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:29:14 -5:00 GMT,200.53.245.29:3410,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:29:28 -5:00 GMT,217.236.21.237:3694,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:29:34 -5:00 GMT,65.34.124.219:3625,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:29:42 -5:00 GMT,213.65.59.172:65187,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:29:58 -5:00 GMT,24.27.111.49:62274,192.168.1.100:3162,TCP (flags:S)
FWIN,2003/11/02,16:29:58 -5:00 GMT,24.27.111.49:62278,192.168.1.100:3162,TCP (flags:S)

It's every minute or so.... as you can see..... What is port 3162?

There seems to be no real description of it's use out there.... So what is the activity?

http://www.sflm.net/Faqs.html <-- perhaps it's this?

I'm wondering if it has something to do with the StatTracker I'm using from Yahoo..... But it is coming in from so many addresses I'm not sure.... I can't see how StatTracker would spread itself around so much.......

Do an netstat -a and see what comes up. Do you actually have this port open? Have you traced those addresses to their origins?

i would go with MSMittens suggestion.

Ok. Tiger I don't know about the Stat Tracker thing. I had it for the first 3 weeks and my Wall wasn't going
Ape ****. I am curious what do you get when you run netstat -a or n

You probably have another type of tool that let's you view what ports are open. Take a look at it.

I haven't heard much about that Port though. Give me a sec I will call my friend and have him do a check to see if he
has that port open.

Damnit you just reminded me I don't change my roster.
Shiiiiiiiiiiiiiiiit

http://www.foundstone.com/index.htm?...desc/fport.htm

Check out "Fport" from Foundstone... needs to run on a command prompt (from M$)

The setup I have is a wireless laptop on the DMZ port of a linksys WAP. The laptop has ZoneAlarm on it and I monitor it through VisualZone so the Netstat's won't help. All this activity is being blocked so I'm not worried, I'm more interested to see if someone else is seeing this huge bump in activity against this one port.

I sit at this machine every day for a couple of hours and have had the visualzone set to "knock-knock" when incoming is blocked. I had not received a single call for this port in the previous week and a half at least - then all of a sudden I'm getting them from all over at a rate of 100/hour or so.

Ms. M: If that license manager you found is the only thing one could expect to find on that port on a regular basis my guess is there's an exploit out there against it.

That's the only thing I could find as a server product. There were other "SFLM" products that seemed to be manufacturing items (Something Floor Line Manager/Manufacturing).

I looked for an exploit but nothing came out directly. There could be exploits or there could be a DNS misconfiguration pointing to the Licensing product but giving the wrong address.

Ms. M: Damn, you're a s nutty as me being on the computer this early..... ;)

DNS error is a possibility I guess but the SFLM site isn't very clear about what the heck it licenses so I wonder why so many of these, clearly, home machines from all over the world would be looking for it.... Looking around the app seems to be *nix only and I nmapped a couple of boxes and they look a lot like windows boxes to me..... <shhhh, that'll be our little secret.... ;) >

I'll be taking a good look through my firewall logs when I get to work to see if I have been picking it up there too. I'll tell you what I find there at about 8:30-9:00 EST. If I'm not seeing it there too then your DNS theory definitely holds more water.

Hum... Why does it not surprise that you got this hit from a windows Box.


Ugh...
/me hangs his head in shame, and says "I haven't been to sleep yet"

I am actually interested if your FW at work has been picking this up to.

The other thing I was thinking about was that someone stuck something other than SFLM on the port (game server, kazaa) and these machines were looking for it. Perhaps a link on a website or something, and again it's a transposed/error ip?

And well, if I intend to get work done today, I get up early so I can get into my office before my colleagues (they tend to yap far more than I like.. ).. :D

Whiz: Well, considering 90%+ of the boxes out there are winx I'd say that the probabilities would be quite high..... ;)

Ms. M: I think you have the answer somewhere there. My firewall is utterly devoid of SYN's on that port as are my other monitors so nothing was pointed at my netblock all day yesterday.

Why does this crap always happen to me..... or am I just overly paranoid? :eek:

Quote:

---

they tend to yap far more than I like..

---

Yeah, I'm surrounded by social workers..... I sometimes think that they are under the impression that the organization is a social outlet for their gossip, baby showers, going away parties etc. etc. etc. I don't know how they ever get any work done...... :rolleyes:

Quote:

---

Why does this crap always happen to me..... or am I just overly paranoid?

---

Naw.. other people aren't paranoid enough. I bet someone is on your network who shares out something. Maybe a quick scan of the subnet to see who might have something shared out on that port would give better details. I'm betting this is the more likely answer since it is SYN packets (first part of the 3-way handshake and the start of any service).

Have you run tcpdump or something to see if there is more there (like data info?)

I don't really want to start any scanning activity of that network. The DSL connection belongs to a friend in his business location. It just happens to be next door to my "watering hole"... :cool: He needed some help adding multiple machines to the connection, I had a WAP lying around doing nothing and a laptop with a wireless card that was equally unemployed.... I figured out that we could all be happy and went ahead and set it all up, (yes, he's fully aware... In fact when he comes into the pub his first comment is "Get out of my computer"... Moi??? :D). Thus, to use his connection to scan his ISP's customers would be inviting trouble.....

I didn't have Ethereal with me and didn't think about packet dumping at that point but I'll be back there tonight and if it's still going on I'll take a look.

WAP?! You didn't mention that... geez... Ummm... Wardriving by some perhaps?

Ms. M: WAP, not mentioned? Sure was:-

Quote:

---

The setup I have is a wireless laptop on the DMZ port of a linksys WAP.

---

You got up too early Ma'am.... ;) .... and if it was a wardriver he wouldn't be getting SYN's from all over the world.... I'd have been seeing them from a local address which would be a little hard since it is MAC filtered to my card and one other that wasn't present at the time.

It's inbound down the DSL, there's no doubt about that unless you have another idea.....

Outside of misdirected address, the only other thing, given that the addresses are primarily Win (the remaining ones are unknowns I take it?) is that there is a new worm and it attempting to propogate on this port picked by the creator. The data from the SYN packets (if there is any) might give a clue on that.. Don't suppose you have a spare box with which to open a port and tarpit the connection?

I'll see if it is still happening tonight and work from there. If it has stopped then I would run with your first thought about misdirected DNS.... If not then I'll run p0f to passively footprint the connections to get a better view of the connecting machines and then ethereal the port to see if there is anything unusual with the SYN packets.

Thanks for the help.... I need all the additional brain cells I can get sometimes.... ;)

Ok Ms. M, I'm going to go with your Kazaa theory but I'll twist it slightly...... ;)

I am not seeing this traffic at home - nor am I seeing it at work. No-one else is owning up to seeing it so we can reasonably conclude that it isn't some new worm since the scans would be more widespread.

I unleashed p0f, (passive fingerprinter), on the connections with the packet dump switch on, cleaned it up a little and came up with this:-

<Mon Nov 03 16:46:33 2003> 200.247.206.23/radioaru.contato.net:3249 - Windows 2000 SP2+, XP SP1 (seldom 98 4.10.2222)
-> 192.168.1.100/MyComputer:3162 (distance 19, link: pppoe (DSL))
[00] 45 00 00 30 db ea 40 00 6d 06 d8 c1 c8 f7 ce 17 | [email protected].......
[10] c0 a8 01 64 0c b1 0c 5a 66 8c a8 76 00 00 00 00 | ...d...Zf..v....
[20] 70 02 40 00 c1 fd 00 00 02 04 05 ac 01 01 04 02 | p.@.............

<Mon Nov 03 16:46:51 2003> 81.15.218.252/masqte.daminet.pl:3469 - Windows 2000 SP2+, XP SP1 (seldom 98 4.10.2222)
-> 192.168.1.100/MyComputer:3162 (distance 16, link: IPSec/GRE)
[00] 45 00 00 30 c4 2a 40 00 70 06 58 85 51 0f da fc | E..0.*@.p.X.Q...
[10] c0 a8 01 64 0d 8d 0c 5a 80 cf a2 24 00 00 00 00 | ...d...Z...$....
[20] 70 02 40 00 18 44 00 00 02 04 05 9c 01 01 04 02 | [email protected]..........

<Mon Nov 03 16:46:52 2003> 80.54.170.49/zy49.neoplus.adsl.tpnet.pl:4910 - Windows 2000 SP2+, XP SP1 (seldom 98 4.10.2222)
-> 192.168.1.100/MyComputer:3162 (distance 19, link: pppoe (DSL))
[00] 45 00 00 30 91 a4 40 00 6d 06 bf af 50 36 aa 31 | [email protected]
[10] c0 a8 01 64 13 2e 0c 5a 08 47 3a 26 00 00 00 00 | ...d...Z.G:&....
[20] 70 02 40 00 24 be 00 00 02 04 05 ac 01 01 04 02 | p.@.$...........

<Mon Nov 03 16:46:52 2003> 81.15.218.252/masqte.daminet.pl:3469 - Windows 2000 SP2+, XP SP1 (seldom 98 4.10.2222)
-> 192.168.1.100/MyComputer:3162 (distance 16, link: IPSec/GRE)
[00] 45 00 00 30 c4 2d 40 00 70 06 58 82 51 0f da fc | [email protected]...
[10] c0 a8 01 64 0d 8d 0c 5a 80 cf a2 24 00 00 00 00 | ...d...Z...$....
[20] 70 02 40 00 18 44 00 00 02 04 05 9c 01 01 04 02 | [email protected]..........

<Mon Nov 03 16:46:53 2003> 67.112.91.235:4642 - Windows 2000 SP4, XP SP 1 (2)
-> 192.168.1.100/MyComputer:3162 (distance 14, link: IPv6/IPIP)
[00] 45 00 00 30 ac ef 40 00 72 06 fa 70 43 70 5b eb | [email protected][.
[10] c0 a8 01 64 12 22 0c 5a ad fa 76 57 00 00 00 00 | ...d.".Z..vW....
[20] 70 02 fd 20 e1 dc 00 00 02 04 05 a0 01 01 04 02 | p.. ............

<Mon Nov 03 16:47:10 2003> 200.53.245.29/cablec5oug.cybercable.net.mx:1857 - Windows 2000 SP2+, XP SP1 (seldom 98 4.10.2222)
-> 192.168.1.100/MyComputer:3162 (distance 24, link: GPRS, T1, FreeS/WAN)
[00] 45 00 00 30 47 dc 40 00 68 06 4b 8c c8 35 f5 1d | [email protected]..
[10] c0 a8 01 64 07 41 0c 5a 10 3c d3 4d 00 00 00 00 | ...d.A.Z.<.M....
[20] 70 02 40 00 cc ea 00 00 02 04 05 64 01 01 04 02 | [email protected]....

<Mon Nov 03 16:47:12 2003> 81.128.136.70:33634 - Windows XP Pro SP1, 2000 SP3 (NAT!)
-> 192.168.1.100/MyComputer:3162 (distance 19, link: sometimes DSL (1))
[00] 45 00 00 30 c4 c1 40 00 6d 06 ad 33 51 80 88 46 | [email protected]
[10] c0 a8 01 64 83 62 0c 5a 68 f7 cd 72 00 00 00 00 | ...d.b.Zh..r....
[20] 70 02 fa f0 26 bf 00 00 02 04 05 2a 01 01 04 02 | p...&......*....

<Mon Nov 03 16:47:20 2003> 68.167.66.169:4404 - Windows 2000 SP4, XP SP 1 (2)
-> 192.168.1.100/MyComputer:3162 (distance 15, link: IPv6/IPIP)
[00] 45 00 00 30 51 b3 40 00 71 06 6e b8 44 a7 42 a9 | [email protected].
[10] c0 a8 01 64 11 34 0c 5a 9f 2a c9 d3 00 00 00 00 | ...d.4.Z.*......
[20] 70 02 fd 20 b6 29 00 00 02 04 05 a0 01 01 04 02 | p.. .)..........

As you can see the SYN's, (P0f only traps the SYN's unless I add some other switches), come from everywhere.... What is interesting is the type of connection the remote's are using.... IPv6, IPSec/GRE????? Encrypted traffic.... IPv6?.... So it must be using 6to4 to route and connect.... So it isn't normal traffic.... But it is pointed at me.....

Granted, I haven't gone and looked at my friends 2 machines, (Win98 and a Mac), but I would _guess_ it isn't down to them. If it is.... I'll throttle him..... :eek:

What I do think is that the IP address for the PPOE his DSL uses has rotated and someone else had this one previously, (I don't watch for this IP changing but I have noticed that it does rotate). I also think they may have been running something like Earthstation 5 which uses proxies and encryption heavily to hide the activity.... But it isn't ES5 from what I have seen because it doesn't use GRE/IPv6.... It's SSL/proxied as far as I know.

Comments/thoughts?

Oh lots of thoughts:

- worm activity? (still might be a possibility)

- trojan activity? (some DDoS/Trojans have encryption methods in them -- nothing says they wouldn't/couldn't use IPSec)

- misdirected traffic (this is the more likely scenario -- whatever they were connecting to before using Windows built-in VPN and IPSec).

- misdirected traffic (again, more likely option -- whatever they were connecting to experimenting with IPv6).

Interesting to say the least.. might want to watch incidents.org and some of the lists to see if others report it. Might also want to forward it to incidents.org to see if they've seen other reports.

Ms. M: Yeah... the more I think about it the stranger it is.... It's become so annoying that I pulled myself back out of the demil zone to stop the darned thing logging it... It's incessant. I went and checked all the port forwarding etc. to make sure it hadn't been changed, checked the logs etc. at the firewall so it is being blocked, which gets my friend off the hook.... :cool:

Actually this IP is getting a ton of traffic on lots of odd ports... Much more than it was before the weekend..... which implies the IP did change and people have picked up on the old "owner" as something of "interest". But the SFLM stuff is multiple per minute from multiple remote addresses right now. Too much for me to be bothered with in some ways..... Interestingly, many of the "attacking" IP's show up as "host down" when they are "investigated".... ;) So there is a certain amount of sophistication going on at the remote location, whether it is by the user or by the software they are using.

I'll take a look at incidents.org but it'll have to be tomorrow 'cos I need to go home to my sweetie now..... Yeah, I have a "soft" spot.... Let's keep that as another "little secret"... ;)

[edit]

Hmmmm... the worm theory you put forward..... It could be explained by a worm that propogates by another port, thus no apparent scan on this one, but it connects via this one to "pick up" it's "little buddy"..... Just a thought....

Hmmm..... A brain cell kicked in...... WOW

[/edit]

have you had any problems with ur zonealarm blocking the traffic. I remember a bug in ZA where if it recieves and blocks a exceeding number of SYN packets (over a hundred or something i think) it will crash. I'm sure some of u've seen/heard it. Just wonderin if they could somehow tell that u have a zonealarm firewall and r tryin to crash it. Just my guess on what they could be tryin to do...i know its far fetched but a high amount of SYN packets and ur firewall bein ZA u could never know.

Tiger: I had some log entries in my logs from Oct 28 that show a handfull of attempts inbound from Internet using that TCP port you reported but nothing alarming. But most interestingly I had about 20 entries inbound from Internet (on same TCP port) using internal LAN IP addresses - some were valid others were not.

I'll watch for any future stuff.

(Interesting thread you have here)