Printable View
Quote:
Fri, 2010-08-27 10:37:02 - UDP packet - Source: 2xx.xxx.xxx.xxx(our ip) - Destination: 2xx.xxx.xxx.xxx (isp dns) - [Ceiling for number of connections reached, dropping packet Src 1403 Dst 53 from SELF]
I get a bazzillion of these logged on my router everytime a consultant comes in and plugs his MAC laptop into our router...he says its probably his IMAP email....
I say its a torrent\p2p client??
your thoughts??
MLF
uhhh dns?
uuuhhh yeah its dns...but why would it roll out 1000s of entries a day while his mac is attached to my router???
And why would I get "number of connections reached" ???
And why it only happens when said consultant is connected???
MLF
right >.< sorry. But at least we can both agree that that traffic is DNS so we can proceed accordingly :D Can you post some of the DNS queries that are being made? That would shed a lot light on the situation.
No...my router only logs incoming ...and not the outgoing??..If he was on my network I would have all requests...but I dont let consultants on the LAN with their machines...I give them internet access direct through the router with a static ip
I don think its his IMAP client...
MLF
Well, the DNS response packets would suffice as well.... actually that would be a lot more helpful now that I think of it. ^.^
I would need to see some of that information if I were to make any sort of discernible judgment on the situation though >.<
If ur gonna spend time on this one, dont f@ck around. Create a Consultant LAN and sniff the packets to get to the bottom of it. Also, even though he's not on ur LAN, he may be sucking up bandwidth and impacting your users. QoS to limit bandwidth consumption on the consultant LAN.
I agree with u. Sounds like p2p/torrent/malware.
Damn those consultants. ;)
FYI... Increasingly, I have been told by clients that I am no longer able to plug my laptop into their network. I use an aircard. Perhaps your evil consultant could do same.
CSR
Ahoy Capt'n Ron...ya ole salt??
Where you been???
Thanks for the reply matey......we will see next time he comes in on what I can do?
Looks like repeated DNS request??...but why??
Anyhoo nice to see you back ;)
SMM aka MLF
Me and me crew been on hiatus at our secret lair, but with summer almost over, it's time to get back to civilization.
Perhaps show him the log and ask him, "wtf"?
I do love copy/paste...
[quote="Morganlefay"]Bull ****.Quote:
he says its probably his IMAP email.... :roll:
One of two things:
P2P using a text file to do multiple lookups.
Malware/Bot searching for home.
Next time idiot boy comes in - get a hold of his MAC and go to Applications->Utilities->Activity Monitor
Same as task manager in Windows.
Also, as csr suggested. WireShark is your friend.
This.Quote:
Originally Posted by dinowuff
A quick dissection of the traffic will tell you exactly what it is. You can use any port you want, but you can't really hide the payload.
Ok...we have developed a new networked device that uses Avahi...
http://avahi.org/wiki/AboutAvahi
to discover and communicate to other devices on the LAN....hence the constant DNS requests going out to our ISP...through 2 routers
I am concerned when a customer plugs this device at home ...the device will have excessive DNS requests through their routers to the customers ISP....Is that going to be an issue?? will the ISPs freak??
Not knowing much about all this and why we have a consultant working on this (at my request)....I want to ask the the guy is it not possible to keep these requests localized within the LAN ???
Too bad hes such an arrogant a$$...else I could try and work with him on this..
I appreciate your thoughts on this!!
off to read up more on this
MLF
Hey MLF:
Why do you need DNS - SD?
I thought you were running on a Windows 2003 AD network?
This is a device we have developed that runs *nix based OS....
MLF
Quote:
Originally Posted by morganlefay
Ah.. Makes sense now. I thought you were a windows only shop.:drink:
This device sits outside our network and is developed for home use...hence the auto discovery of other devices...
MLF
Quote:
Originally Posted by morganlefay
/self mode set = confused again
It has its on LAN.....with other devices...separate from our corporate LAN sharing our internet..
Its own "subnet" if you will ;-)
Ok...figured it out...well kinda sorta....
its not our device... phew...we are about to go into production with this
its something on his laptop...not sure what it is though.....its some kind of P2P client for sure.
MLF
Is this in a setting where you are the Network Admin? Basically I'm wondering what kind of say you have over what people do, and, if you can make a "Policy" where all people using things on your network have to follow what you've set.
This would make things easier, and you can make some BS policy where you have rules against P2P traffic if it's an actual problem. If the person doing this has a valid reason, that's one thing (He may be using P2P to get legal software... I know, most probably don't, but some software is actually released with P2P and it's a better way of getting it than the main server the stuff is hosted on) so if it's valid and it's not bogging you down, that's one thing, but if he's using it to grab movies or music illegally, then, well, you know.
If you can get away with it, make a policy that dictates you need to know what software each client is using before they're allowed access, and if your boss or whoever you have to report to gets iffy about it, just say "I'm making sure our asses are covered in the event that someone comes in from the outside, plugs into the network, downloads a few thousand songs or a few hundred movies, and we get sued for Piracy" which is normally enough to get your way or at least get them to agree since no one likes being sued.
This would allow you some control over what network apps people are actually allowed to use. And if this is in fact a setting where you are responsible for this stuff, well, again, you should be able to at the very least, make a form of a policy where you can say no to some moron attempting to turn your network into a piracy house.
The College I went to had a policy where students were allowed to not only bring their laptops in, but hook them up to the network and surf the net, which is cool because when you were doing something like a project, you were able to grab info from the net, whack it into a Presentation software package, and go.
They did have a rule though, where P2P wasn't allowed for things that weren't legal. One of the main professor's allowed some P2P because for Linux distros when we did Security + and Linux + both, it was easy to let people grab a distro of Linux over Bit Torrent, or whatever else, and then go from there. The college didn't mind because it saved them money on CDs and so on, and it worked out.
However, the Network Admin, had a policy where if this was abused, they lost access. You can pretty easily tell with the right software. I'm not sure if you have access to a REAL Packet Sniffer (A hardware model for instance) but it can pretty much plug in, watch, and print out what happens that looks suspicious.
And did I read this right? You have a Unix based product in use and it's working out for you? And you're admitting it wasn't the issue? :o ;)
Also, if this guy is, as you've said, got a HUGE attitude problem, I'd personally go to my boss, bring up the situation, and say that he's basically not the type who's going to admit to anything, and that he's got a problem with people in general. This of course adds to the CYA principle, and makes sure you aren't the one who takes the blast when "it" hits the fan.
Yes we have a Unix product....I have never stated windows is better the unix ever...and I would like you to find any thread where I have!
I have always maintained...................... depending on the environment and functionality required will best determine the OS used.
We need a read only device...and we decided unix based is best for the functionality....and we hired an contractor to develop it seeing it is beyond my skill set....always hire people that know more then you.
He is not on our internal network but shares our internet and every so often he fires up some program that creates the log entries.......as stated he claims its his IMAP client and I call bulsh1t.
Thats the gist of the thread.
MLF
Haven't kept myself up2date with the entire thread, so if something below is already mentioned then please don't hate on me. :halo:Quote:
Originally Posted by morganlefay
Is it possible that next time he comes in, that he's laptop/device get's checked out?
ie set up a "Closed environment" and have a scan of the "Network" activity that tries to establish a connection, have process explorer up and running and keep an eye on processes that launch etc etc.
in the current logs you have how big are the intervals? are they every 5mins or shorter?
source is our IP Destination is our ISPs DNSQuote:
Wed, 2010-09-01 14:13:41 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4488 Dst 53 from SELF]
Wed, 2010-09-01 14:13:41 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4489 Dst 53 from SELF]
Wed, 2010-09-01 14:13:41 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4490 Dst 53 from SELF]
Wed, 2010-09-01 14:13:41 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4491 Dst 53 from SELF]
Wed, 2010-09-01 14:13:41 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4492 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4493 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4494 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4495 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4496 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4497 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4498 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4499 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4500 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4501 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4502 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4503 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4504 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4505 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4506 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4507 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4508 Dst 53 from SELF]
Wed, 2010-09-01 14:13:42 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4509 Dst 53 from SELF]
Wed, 2010-09-01 14:13:43 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4510 Dst 53 from SELF]
Wed, 2010-09-01 14:13:43 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4511 Dst 53 from SELF]
Wed, 2010-09-01 14:13:43 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4512 Dst 53 from SELF]
Wed, 2010-09-01 14:13:43 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4513 Dst 53 from SELF]
Wed, 2010-09-01 14:13:43 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4514 Dst 53 from SELF]
Wed, 2010-09-01 14:13:43 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4515 Dst 53 from SELF]
Wed, 2010-09-01 14:13:43 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4516 Dst 53 from SELF]
Wed, 2010-09-01 14:13:43 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4517 Dst 53 from SELF]
Wed, 2010-09-01 14:13:53 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4589 Dst 53 from SELF]
Wed, 2010-09-01 14:13:53 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4590 Dst 53 from SELF]
Wed, 2010-09-01 14:13:54 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4591 Dst 53 from SELF]
Wed, 2010-09-01 14:13:54 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4592 Dst 53 from SELF]
Wed, 2010-09-01 14:13:54 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4593 Dst 53 from SELF]
Wed, 2010-09-01 14:13:54 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4594 Dst 53 from SELF]
Wed, 2010-09-01 14:13:54 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4595 Dst 53 from SELF]
Wed, 2010-09-01 14:13:54 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4596 Dst 53 from SELF]
Wed, 2010-09-01 14:13:57 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4597 Dst 53 from SELF]
Wed, 2010-09-01 14:13:57 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4598 Dst 53 from SELF]
Wed, 2010-09-01 14:14:02 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4631 Dst 53 from SELF]
Wed, 2010-09-01 14:14:02 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4632 Dst 53 from SELF]
Wed, 2010-09-01 14:14:02 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4633 Dst 53 from SELF]
Wed, 2010-09-01 14:14:02 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4634 Dst 53 from SELF]
Wed, 2010-09-01 14:14:02 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4635 Dst 53 from SELF]
Wed, 2010-09-01 14:14:03 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4636 Dst 53 from SELF]
Wed, 2010-09-01 14:14:03 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4637 Dst 53 from SELF]
Wed, 2010-09-01 14:14:03 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4638 Dst 53 from SELF]
Wed, 2010-09-01 14:14:03 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4639 Dst 53 from SELF]
Wed, 2010-09-01 14:14:03 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4640 Dst 53 from SELF]
Wed, 2010-09-01 14:14:04 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4641 Dst 53 from SELF]
Wed, 2010-09-01 14:14:04 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4642 Dst 53 from SELF]
Wed, 2010-09-01 14:14:04 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4643 Dst 53 from SELF]
Wed, 2010-09-01 14:14:04 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4644 Dst 53 from SELF]
Wed, 2010-09-01 14:14:04 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4645 Dst 53 from SELF]
Wed, 2010-09-01 14:14:05 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4646 Dst 53 from SELF]
Wed, 2010-09-01 14:14:05 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4647 Dst 53 from SELF]
Wed, 2010-09-01 14:14:06 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4648 Dst 53 from SELF]
Wed, 2010-09-01 14:14:06 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4649 Dst 53 from SELF]
Wed, 2010-09-01 14:14:06 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4650 Dst 53 from SELF]
Wed, 2010-09-01 14:14:06 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4651 Dst 53 from SELF]
Wed, 2010-09-01 14:14:06 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4652 Dst 53 from SELF]
Wed, 2010-09-01 14:14:06 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4653 Dst 53 from SELF]
Wed, 2010-09-01 14:14:06 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4654 Dst 53 from SELF]
Wed, 2010-09-01 14:14:07 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4655 Dst 53 from SELF]
Wed, 2010-09-01 14:14:07 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4656 Dst 53 from SELF]
Wed, 2010-09-01 14:14:07 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4657 Dst 53 from SELF]
Wed, 2010-09-01 14:14:09 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4658 Dst 53 from SELF]
Wed, 2010-09-01 14:14:09 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4659 Dst 53 from SELF]
Wed, 2010-09-01 14:14:09 - UDP packet - Source:xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4660 Dst 53 from SELF]
Wed, 2010-09-01 14:14:09 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4661 Dst 53 from SELF]
Wed, 2010-09-01 14:14:09 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4662 Dst 53 from SELF]
Wed, 2010-09-01 14:14:09 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4663 Dst 53 from SELF]
Wed, 2010-09-01 14:14:10 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4664 Dst 53 from SELF]
Wed, 2010-09-01 14:14:10 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4665 Dst 53 from SELF]
Wed, 2010-09-01 14:14:10 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4666 Dst 53 from SELF]
Wed, 2010-09-01 14:14:10 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4667 Dst 53 from SELF]
Wed, 2010-09-01 14:14:11 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4668 Dst 53 from SELF]
Wed, 2010-09-01 14:14:11 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4669 Dst 53 from SELF]
Wed, 2010-09-01 14:14:11 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4670 Dst 53 from SELF]
Wed, 2010-09-01 14:14:11 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4671 Dst 53 from SELF]
Wed, 2010-09-01 14:14:12 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4672 Dst 53 from SELF]
Wed, 2010-09-01 14:14:12 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4673 Dst 53 from SELF]
Wed, 2010-09-01 14:14:12 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4674 Dst 53 from SELF]
Wed, 2010-09-01 14:14:12 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4675 Dst 53 from SELF]
Wed, 2010-09-01 14:14:13 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4676 Dst 53 from SELF]
Wed, 2010-09-01 14:14:13 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4677 Dst 53 from SELF]
Wed, 2010-09-01 14:14:13 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4678 Dst 53 from SELF]
Wed, 2010-09-01 14:14:13 - UDP packet - Source: xxx.xxx.xxx.xxx - Destination: xxx.xxx.xxx.xxx - [Ceiling for number of connections reached, dropping packet Src 4679 Dst 53 from SELF]
Runs for about 15 min at a time
MLF
Appear to be e-mail client related, has there e-mail client to check for new mail every 1 -> 2 minutes :eek:
i imagine being a mac he has that push to device enabled.
personally i would "Sandbox" the machine into a controlled environment, if it has wireless device, then let it connect to a fake hotspot and run a air-scanner to monitor the in-bound outbound traffic.
are you able to have some physical access to the mac next time he comes by?
If it was p2p there would be more "Data" logged especially if you have ports blocked, no port forwarding etc.
HYBRID are you suggesting that is IMAP Polling?
So it IS his mail client...pushing it to his phone.....why all the DNS stuff??
I have no physical access to his machine...
MLF
The app he is using is morpheus P2P
Now what to do about it
MLF
You can use any packet-filtering firewall, like ipchains or iptables in Linux or ISA Server in Win 2000 Server, to block out any network activity from taking place.Quote:
Originally Posted by morganlefay
6346-6347 for the Service ports, and TCP for Protocol.
didn't they shut off that morpheus p2p awhile back? it's been a long long time since i last used a torrent to grab *nix distro's so kind of out of the loop. :(
Morpheus went off line in 2008 according to Wikii.
MLF not knowing your set up but...
Can your switched filter by mac address? Is it easy to set up a vLan?
His laptop has a virtual machine on it...it was also using multiple ports on the wireless connection...multiple MAC addresses.
We spoke to him and asked that he only run applications required for the project and to ensure all P2P apps were not running while on site as it is against out AUP....and the traffic mysteriously stopped ....and I am sure he is still getting his email.
He has that typical arrogance ...firstly because we are a MS shop we wouldnt know...and secondly some female running a network must be an idiot and wouldnt know.
Yeap it took me some time to figure out what it was.....but I am no fookin id10t...and I dislike when people undermine me.....
MLF
EDIT>FYI the software can use other P2P networks such as the Neo Network, Gnutella, Limewire etc and is still available for download
MLF.............
:xbones:KILL!!!:xbones:
I would also test his work rather more carefully than usual?.............if he doesn't know/care what effect his actions are having on client's systems, it raises other questions in my mind. :halo:
I have had several dud contractors in my time! :eek:
I would of loved to be a fly on the wall when you ripped him a new 1. :D
I hope that while you were "Examining" the machine that the offending application was un-installed.
"I did type out a bigger post, but decided to just make it shorter, hada bit to drinky so would of been a ramble." :duh:
MLF:
I know you know this - and I apologize as it is a rather old trick. But remember. You have web usage logs that show legit visits to Pr0n sites.
You can always modify the offending ip address in the logs...
For me it's a bit harder, cause of web sense, so I just copy the db, and update the FQDN field then run the reports. No one ever checks to see if 157.166.255.19 (www.cnn.com) is really www.ilikelittleboys dot com
He has shut everything down...supposedly.
Thanks Nihil...I will keep an eye on his stuff...trying to get him to document everything...and so far his documented how tos dont work....typical is all I can say. I have no real say here as he is working with a VP and Engineering...both Gods in their own minds and in the company's <rolleyes>
I still dont trust him...
And Dino...you are evil and my hero...mentor...I like the way your mind works ;)
MLF
What about me? My funny yet sometimes WTF worthy exploits with a keyboard have mad laughter countless times :(Quote:
Originally Posted by morganlefay
MLF
Arrrrrrgh! I have been there, you have my sincerest sympathies.Quote:
Thanks Nihil...I will keep an eye on his stuff...trying to get him to document everything...and so far his documented how tos dont work....typical is all I can say. I have no real say here as he is working with a VP and Engineering...both Gods in their own minds and in the company's
Don't you just hate it when user departments go out and "do their own thing" and we know full well they will expect us to support it afterwards:eek: