[178825] in North American Network Operators' Group
Re: Purpose of spoofed packets ???
daemon@ATHENA.MIT.EDU (Roland Dobbins)
Tue Mar 10 19:51:32 2015
X-Original-To: nanog@nanog.org
From: "Roland Dobbins" <rdobbins@arbor.net>
To: "nanog@nanog.org" <nanog@nanog.org>
Date: Wed, 11 Mar 2015 06:51:23 +0700
In-Reply-To: <851dacde19f14eeca82d0c9b6aff89c8@pur-vm-exch13n1.ox.com>
Errors-To: nanog-bounces@nanog.org
On 11 Mar 2015, at 6:40, Matthew Huff wrote:
> I assume the source address was spoofed, but this leads to my
> question. Since the person that submitted the report didn't mention a
> high packet rate (it was on ssh port 22), it doesn't look like some
> sort of SYN attack, but any OS fingerprinting or doorknob twisting
> wouldn't be useful from the attacker if the traffic doesn't return to
> them, so what gives?
Highly-distributed, pseudo-randomly spoofed SYN-flood happened to
momentarily use one of your addresses as a source. pps/source will be
relatively low, whilst aggregate at the target will be relatively high.
Another very real possibility is that the person or thing which sent you
the abuse email doesn't know what he's/it's talking about.
;>
-----------------------------------
Roland Dobbins <rdobbins@arbor.net>
