Subject: think - I'm attacked - what do YOU mean ????

From: "Dirk.Nerling" <[email-masked]>
Date: Sun, 5 Mar 2000 11:41:11 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,

I found this in my logfiles, some tried to use nntp, ftp and telnet - not
unusal - I find often some of these kids how are searching for a free news
server. But why do I get "Socket is not connected"  and "cannot get
peername" from TIS?
What should I do????

best regards Dirk

Mar  5 07:55:48 wall /kernel: ipfw: 500 Accept ICMP:8.0 216.210.30.47
194.139.111.2 in via de1
Mar  5 07:55:48 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2
216.210.30.47 out via de1
Mar  5 07:55:50 wall smap[9460]: getpeername failed: Socket is not connected
Mar  5 07:55:50 wall smap[9460]: cannot get remote host
Mar  5 07:55:56 wall plug-gw[9461]: deny
host=ppp-5800-01a-3047.mtl.total.net/216.210.30.47 service=nntp
Mar  5 07:55:58 wall netacl[9462]: getpeername failed: Socket is not
connected
Mar  5 07:55:58 wall netacl[9462]: fwtksyserr: in.ftpd exiting - cannot get
peername
Mar  5 07:56:01 wall netacl[9463]: getpeername failed: Socket is not
connected
Mar  5 07:56:01 wall netacl[9463]: fwtksyserr: in.teln exiting - cannot get
peername
Mar  5 07:56:15 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2
216.210.30.47 out via de1

Mar  5 08:07:23 wall /kernel: ipfw: 500 Accept ICMP:8.0 216.210.30.47
194.139.111.2 in via de1
Mar  5 08:07:23 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2
216.210.30.47 out via de1
Mar  5 08:07:31 wall netacl[9486]: getpeername failed: Socket is not
connected
Mar  5 08:07:31 wall netacl[9486]: fwtksyserr: in.teln exiting - cannot get
peername
Mar  5 08:07:34 wall plug-gw[9487]: getpeername failed: Socket is not
connected
Mar  5 08:07:34 wall plug-gw[9487]: cannot get remote host: Socket is not
connected
Mar  5 08:07:40 wall netacl[9488]: getpeername failed: Socket is not
connected
Mar  5 08:07:40 wall netacl[9488]: fwtksyserr: in.ftpd exiting - cannot get
peername
Mar  5 08:07:46 wall smap[9489]: getpeername failed: Socket is not connected
Mar  5 08:07:46 wall smap[9489]: cannot get remote host
Mar  5 08:07:51 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2
216.210.30.47 out via de1

--
Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone:
++49-361-4407144
            PGP Fingerprint: C559 FF0E BAD0 9E09 F720  20F3 683E 357F 69B5
CC83
                       		http://www.pdv.de

---

From: Rick Murphy <[email-masked]>
Date: Sun, 05 Mar 2000 08:03:41 -0500

>server. But why do I get "Socket is not connected"  and "cannot get

That almost always means someone has initiated a connection to a port then 
immediately disconnected it.  Having several of these happen in a short 
timespan is a signature of a port scan.

>What should I do????

Nothing bad happpened, so you don't need to panic. Keep track of the source 
IP and if they come back repeatedly, complain to their isp.
         -Rick

---

From: "Joseph Judge" <[email-masked]>
Date: Sun, 5 Mar 2000 14:24:29 -0500

Looks like some nosy bastard. This happens often throughout a
connected year. Its when there are a _LOT_ of these streaming
in your log files that would indicate someone more intent on
pounding you (DoS) than just checking you out.

	-joe

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of Dirk.Nerling
> Sent: Sunday, March 05, 2000 5:41 AM
> To: Firewall Toolkit (M-list); [email-masked]'
> Subject: think - I'm attacked - what do YOU mean ????
>
>

---

From: "Tom Krotchko" <[email-masked]>
Date: Sun, 5 Mar 2000 16:40:09 -0500

It seems to me ever since the week of the DDoS attacks, I'm getting
a lot of probes on all my firewalls with UDP_ECHO packets. 

I swear kids today have no imagination when it comes to hacking <G>.

Something for everyone to consider; you have to have some "known"
entries to your organization.  Typically this would be your mail
gateway and public web sites (and even there, I think it might be
worthwhile to set it up outside your organization whether in a DMZ
or completely outsourced).

However, for large organization that have multiple entry paths, I 
think you're crazy for advertising your other pathways with
(a) DNS records (b) Reverse DNS records.  For Fortune 1000's;
its practically waving a red flag in front of a bull.  

First rule of being ignored: Be invisible.

---

From: "Joseph Judge" <[email-masked]>
Date: Sun, 5 Mar 2000 21:05:14 -0500

This is what auditors call "enticement risk" -- and, at a smaller
level, why folks should turn off finger, rwho, rusers, EXPN on their
email gateway, not place the corporate directory in a public LDAP
server, etc, etc.

	- joe

> Behalf Of Tom Krotchko
> Sent: Sunday, March 05, 2000 4:40 PM
> To: Joseph Judge; Dirk.Nerling; Firewall Toolkit (M-list);
> [email-masked]
> Subject: RE: think - I'm attacked - what do YOU mean ????
> 
>

---

From: Chris Chavez <[email-masked]>
Date: Sun, 05 Mar 2000 21:44:43 -0800

Hello,

With this thought (being invisible) in mind.  Is there a way to disable ICMP echo
replys?

Chris Chavez

---

From: "Larry Jackson" <[email-masked]>
Date: Mon, 6 Mar 2000 03:19:35 -0500

I use ipf and setup a rule like:
block in on $EXT_IF proto icmp all

or to only allow the firewall to ping out I added:
pass in log on $EXT_IF proto icmp from any to any icmp-type echo
pass in log on $EXT_IF proto icmp from any to any icmp-type echorep
pass out on $EXT_IF proto icmp from any to any

Larry