Re: Bad loopback traffic not stopped by ipfw.

From: Tony Frank (tfrank_at_optushome.com.au)
Date: 02/27/04

  • Next message: Zhang Weiwu: "ppp server: arp proxy things? (re-post)" 
    Date: Sat, 28 Feb 2004 02:14:05 +1100
To: Gleb Smirnoff <glebius@cell.sick.ru>, Iasen Kostov <tbyte@OTEL.net>, freebsd-net@freebsd.org

    Hi all,

    On Wed, Feb 25, 2004 at 05:21:34PM +0300, Gleb Smirnoff wrote:
    > On Wed, Feb 25, 2004 at 04:19:51PM +0200, Iasen Kostov wrote:
    > I> >>16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 >
    > I> >>192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0
    > I> >
    > I> >This is some kind of Win32 virus. This floods can be easily
    > I> >stopped by ipfw rule:
    > I> >
    > I> >deny tcp from any to any tcpflags rst,ack
    > I> >
    > I> These packets never reach IPFW as we can see.
    >
    > Ughu. Really.
    > But I have millions of them from non-localhost addresses.
    >

    This maybe is of interest?

    http://www.dshield.org/pipermail/list/2004-January/014027.php

    Regards,

    Tony
    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Zhang Weiwu: "ppp server: arp proxy things? (re-post)"