Printable View
This probably belongs in the newbie questions section, but here goes. I got someone poking around in my DMZ that is spoofing localhost (127.0.0.1), Now the firewall is blocking all his/her probes, but my question, is their anyway to determine the "real" IP address?
Thanks
Is this a multi-user network your administering or a home setup.
Quote:
multi-user corporate network.
Cheers:
At this point is a local user still a suspect? If they are it would be easy to put a sniffer on the local network and search for probes of this type.
According to what I am looking at in my firewall, these probes are inbound from the internet and are not originating from my LAN/WAN.Quote:
Originally posted here by extremez
At this point is a local user still a suspect? If they are it would be easy to put a sniffer on the local network and search for probes of this type.
That's a start, BTW what firewall are you using if you don't mind telling?
Checkpoint NGQuote:
Originally posted here by extremez
That's a start, BTW what firewall are you using if you don't mind telling?
The probes are:
Source port = HTTP
Protocol = TCP
Destination port = Various
Cheers:
Can you determine if this is probing or more of a DOS attack, where the attacker tries to open up tons of dud connections, or get the server stuck in a localhost-loop? With a spoofed ip connection like this, that's not meant to be returned to the sender, it pretty hard to do any tracing, you could report the traffic to your ISP and that's about it, an advanced spoof where they use redirects and what not, so that the traffic does return to them(indirectly) then you have something to work with, most spoofed attacks though, are by brainless skiddies who don't understand that if they use some spoofing software to hide their IP address, the target has no way of responding, thus making their probes worthless.
Well if it is a DOS, it's not very effective :pQuote:
We're going to setup a sniffer in the DMZ for a while and see what that will give us. I am not sure our ISP is going to be much help, we are in the process of switching providers and our current ISP is a little pissed at us for not renewing them.
Cheers:
That would hamper relations.
I thought you said your firewall was blocking all attempts? Are they making it through to your DMZ??
They are targeting boxes in the DMZ but aren't getting through, but I do now see your point, setting up a sniffer in the DMZ ain't going to do us much good :duh:Quote:
Originally posted here by extremez
That would hamper relations.
I thought you said your firewall was blocking all attempts? Are they making it through to your DMZ??
We'll sniff the external interface on the firewall, that should show us something.
Cheers:
If they are using spoofed IP Address then they can't be expecting to get a connection, since the return address will not be correct.
However, are you seeing any other attempts from other 'more real' looking IPs at the same time, since if they are trying to probe & get some information back, one of thes addresses will be real.
Steve
Not sure if checkpoint has the ability to set it to not allow spoofed IP's. I know on all my cisco firewalls I have anti spoofing turned on. Pretty much if I can't do a reverse look up back to you, your not connecting..
Do you have a syslog or anything running?
Nothing that seems to have any pattern or structure Steve.Quote:
Originally posted here by steve.milner
If they are using spoofed IP Address then they can't be expecting to get a connection, since the return address will not be correct.
However, are you seeing any other attempts from other 'more real' looking IPs at the same time, since if they are trying to probe & get some information back, one of thes addresses will be real.
Steve
Yes checkpoint can disallow spoofing, that's why this cowboy is being dropped.Quote:
Originally posted here by symtech
Not sure if checkpoint has the ability to set it to not allow spoofed IP's. I know on all my cisco firewalls I have anti spoofing turned on. Pretty much if I can't do a reverse look up back to you, your not connecting..
Do you have a syslog or anything running?
Cheers:
Exactly, No prob ;)Quote:
They are targeting boxes in the DMZ but aren't getting through, but I do now see your point, setting up a sniffer in the DMZ ain't going to do us much good
DjM: Are you allowing outside client's to connect t you're proxy on port 80 do you even have a proxy server running on port 80 ?that can be used to probe the internal LAN like a port scan like doing http://<ip>:25 im not wanting to get right in to it the now i have had a few beers but that could be causing the localhost queries to ports on the lan
Short answer, no. We don't have a proxy.Quote:
Originally posted here by prodikal
DjM: Are you allowing outside client's to connect t you're proxy on port 80 do you even have a proxy server running on port 80 ?that can be used to probe the internal LAN like a port scan like doing http://<ip>:25 im not wanting to get right in to it the now i have had a few beers but that could be causing the localhost queries to ports on the lan
Thanks for your help, go have a few more beers and let me know if you come up with anything else. (some of my best work is done with a belly full of beer) :D
Cheers:
sounds more like an attempted smurf attack rather than an intruder. you should deny incomming 127.0.0.1 at your router
Yea, this is what I would like to do too Tedob1, however the router is owned and controlled by our current ISP, who, like I said, is a little pissed at us, I doubt they would put any priority on putting in that router rule for us.Quote:
Originally posted here by Tedob1
sounds more like an attempted smurf attack rather than an intruder. you should deny incomming 127.0.0.1 at your router
Cheers:
the router that connect us to the internet is owned by UUnet but when they set it up they gave me the user name and password so i can make changes. call them ask them, what have you got to loose. if worse comes to worse get another router
Hopefully, by the end of Feb. we will have a new router (via a new provider). We will have control over that router, so we will be able to make changes like this. As for calling our current provider and asking for anything, it would be easier to push rope. :pQuote:
Cheers: