SYN attack?

Hi Folks,

Just checking the /var/log/messages and I see the following (excerpt):

Aug 25 10:45:05 localhost kernel: IN-internet:IN=eth0 OUT= MAC=fe:fd:46:55:81:37:00:02:fc:64:d8:af:08:00 SRC=70.73.58.120 DST=70.85.129.55 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=30039 DF PROTO=TCP SPT=3289 DPT=135 WINDOW=16384 RES=0x00 SYN URGP=0
Aug 25 10:51:49 localhost kernel: IN-internet:IN=eth0 OUT= MAC=fe:fd:46:55:81:37:00:02:fc:64:d8:af:08:00 SRC=151.57.22.226 DST=70.85.129.55 LEN=404 TOS=0x00 PREC=0x00 TTL=52 ID=33002 PROTO=UDP SPT=31186 DPT=1026 LEN=384
Aug 25 11:08:02 localhost kernel: IN-internet:IN=eth0 OUT= MAC=fe:fd:46:55:81:37:00:d0:ba:1f:b5:cf:08:00 SRC=108.196.65.140 DST=70.85.129.55
LEN=404 TOS=0x00 PREC=0x00 TTL=57 ID=8496 PROTO=UDP SPT=31186 DPT=1026 LEN=384
Aug 25 11:09:58 localhost kernel: IN-internet:IN=eth0 OUT= MAC=fe:fd:46:55:81:37:00:d0:ba:1f:b5:cf:08:00 SRC=66.199.245.201 DST=70.85.129.55
LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=53457 DF PROTO=TCP SPT=1770 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0
Aug 25 11:10:01 localhost kernel: IN-internet:IN=eth0 OUT= MAC=fe:fd:46:55:81:37:00:d0:ba:1f:b5:cf:08:00 SRC=66.199.245.201 DST=70.85.129.55
LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=55647 DF PROTO=TCP SPT=1770 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0
Aug 25 11:32:46 localhost kernel: IN-internet:IN=eth0 OUT= MAC=fe:fd:46:55:81:37:00:02:fc:64:d8:af:08:00 SRC=70.68.73.144 DST=70.85.129.55 LEN=64 TOS=0x00 PREC=0x00 TTL=37 ID=22207 DF PROTO=TCP SPT=2900 DPT=135 WINDOW=53760 RES=0x00 SYN URGP=0
Aug 25 11:51:05 localhost kernel: IN-internet:IN=eth0 OUT= MAC=fe:fd:46:55:81:37:00:d0:ba:1f:b5:cf:08:00 SRC=81.176.69.92 DST=70.85.129.55 LEN=40 TOS=0x00 PREC=0x00 TTL=97 ID=256 DF PROTO=TCP SPT=80 DPT=1222 WINDOW=16384 RES=0x00 ACK SYN URGP=0

Can anyone advise what's going on here? Doesn't look that high traffic (the requests seem quite spaced out, and not all from the same host), but I wasn't sure if it's something I should be worried about.

Thanks, Tom

3 Replies

Replying to my own posting here…

Seems like it's definitely a bunch of suspect hacking attempts. The DPT is the destination port, and from looking at them they seem to be things like MS DTC… I tried doing a telnet to my server on that port and got the same error messages in /var/log/messages.

I'm using firehol as my firewall (well, actually as a firewall builder). Will do some investigation on logs for that and see what I can see…

locate email by whois , then send an email to them with the evidence in logs. ask to block the packets and to notify you what actions they take.

I also use firehol and see this in my logs… Any info at all on what this is and how to fix it would be great.

Thanks

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct