Announcement

Collapse
No announcement yet.

Please Help! I think I'm being watched!

Collapse
X
Collapse
 
  • Page of 2
  • Filter
  • Time
  • Show
Clear All
new posts
Previous 1 2 template Next
  • #16
    Just for fun, I sniffed the traffic coming into my cable modem. Basically I see a ton of ARP requests. Why I am seeing so many seemed a tad weird since the whole point of arp is to prevent excessive traffic since the mac to ip binding will be cached. I am seeing about 12 Pps and they are all going to the 48.bit address of ff-ff-ff-ff-ff-ff(broadcast). All of the http traffic I am seeing is very minimal so it appears the code red worm has died down.
    The bottom line is Kindness is that I think you are seeing the normal everyday traffic because cable is a shared medium so you will see traffic from just about every damn person on your subnet. Here is a text version of 3 captured packets out of the 1200 or so I captured.


    - - - - - - - - - - - - - - - - - - - - Frame 668 - - - - - - - - - - - - - - - - - - - -
    \"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"
    " "," 668","0.039.137 ","Broadcast ","Motrla1AC0D3 "," 60 ","ARP"," C PA=[24.0.88.68] PRO=IP"
    DLC: ----- DLC Header -----
    DLC:
    DLC: Frame 668 arrived at 20:52:05.3859; frame size is 60 (003C hex) bytes.
    DLC: Destination = BROADCAST FFFFFFFFFFFF, Broadcast
    DLC: Source = Station Motrla1AC0D3
    DLC: Ethertype = 0806 (ARP)
    DLC:
    ARP: ----- ARP/RARP frame -----
    ARP:
    ARP: Hardware type = 1 (10Mb Ethernet)
    ARP: Protocol type = 0800 (IP)
    ARP: Length of hardware address = 6 bytes
    ARP: Length of protocol address = 4 bytes
    ARP: Opcode 1 (ARP request)
    ARP: Sender's hardware address = 08003E1AC0D3
    ARP: Sender's protocol address = [24.0.88.1]
    ARP: Target hardware address = 000000000000
    ARP: Target protocol address = [24.0.88.68]
    ARP:
    ARP: 18 bytes frame padding
    ARP:
    ADDR HEX ASCII
    0000: ff ff ff ff ff ff 08 00 3e 1a c0 d3 08 06 00 01 | ÿÿÿÿÿÿ..>.ÀÓ....
    0010: 08 00 06 04 00 01 08 00 3e 1a c0 d3 18 00 58 01 | ........>.ÀÓ..X.
    0020: 00 00 00 00 00 00 18 00 58 44 61 77 e4 78 00 00 | ........XDawäx..
    0030: 61 11 06 02 ff ff ff ff ff ff 08 00 | a...ÿÿÿÿÿÿ..

    - - - - - - - - - - - - - - - - - - - - Frame 669 - - - - - - - - - - - - - - - - - - - -
    \"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"
    " "," 669","0.002.287 ","Broadcast ","Motrla1AC0D3 "," 60 ","ARP"," C PA=[24.6.254.140] PRO=IP"
    DLC: ----- DLC Header -----
    DLC:
    DLC: Frame 669 arrived at 20:52:05.3882; frame size is 60 (003C hex) bytes.
    DLC: Destination = BROADCAST FFFFFFFFFFFF, Broadcast
    DLC: Source = Station Motrla1AC0D3
    DLC: Ethertype = 0806 (ARP)
    DLC:
    ARP: ----- ARP/RARP frame -----
    ARP:
    ARP: Hardware type = 1 (10Mb Ethernet)
    ARP: Protocol type = 0800 (IP)
    ARP: Length of hardware address = 6 bytes
    ARP: Length of protocol address = 4 bytes
    ARP: Opcode 1 (ARP request)
    ARP: Sender's hardware address = 08003E1AC0D3
    ARP: Sender's protocol address = [24.6.254.1]
    ARP: Target hardware address = 000000000000
    ARP: Target protocol address = [24.6.254.140]
    ARP:
    ARP: 18 bytes frame padding
    ARP:
    ADDR HEX ASCII
    0000: ff ff ff ff ff ff 08 00 3e 1a c0 d3 08 06 00 01 | ÿÿÿÿÿÿ..>.ÀÓ....
    0010: 08 00 06 04 00 01 08 00 3e 1a c0 d3 18 06 fe 01 | ........>.ÀÓ..þ.
    0020: 00 00 00 00 00 00 18 06 fe 8c 45 00 00 1c b7 43 | ........þŒE...·C
    0030: 61 11 06 02 ff ff ff ff ff ff 08 00 | a...ÿÿÿÿÿÿ..

    - - - - - - - - - - - - - - - - - - - - Frame 670 - - - - - - - - - - - - - - - - - - - -
    \"Flags \",\"Frame \",\"Delta Time \",\"Destination \",\"Source \",\"Bytes\",\"Protocol \",\"Summary\"
    " "," 670","0.002.476 ","Broadcast ","Motrla1AC0D3 "," 60 ","ARP"," C PA=[24.1.126.226] PRO=IP"
    DLC: ----- DLC Header -----
    DLC:
    DLC: Frame 670 arrived at 20:52:05.3907; frame size is 60 (003C hex) bytes.
    DLC: Destination = BROADCAST FFFFFFFFFFFF, Broadcast
    DLC: Source = Station Motrla1AC0D3
    DLC: Ethertype = 0806 (ARP)
    DLC:
    ARP: ----- ARP/RARP frame -----
    ARP:
    ARP: Hardware type = 1 (10Mb Ethernet)
    ARP: Protocol type = 0800 (IP)
    ARP: Length of hardware address = 6 bytes
    ARP: Length of protocol address = 4 bytes
    ARP: Opcode 1 (ARP request)
    ARP: Sender's hardware address = 08003E1AC0D3
    ARP: Sender's protocol address = [24.1.126.1]
    ARP: Target hardware address = 000000000000
    ARP: Target protocol address = [24.1.126.226]
    ARP:
    ARP: 18 bytes frame padding
    ARP:
    ADDR HEX ASCII
    0000: ff ff ff ff ff ff 08 00 3e 1a c0 d3 08 06 00 01 | ÿÿÿÿÿÿ..>.ÀÓ....
    0010: 08 00 06 04 00 01 08 00 3e 1a c0 d3 18 01 7e 01 | ........>.ÀÓ..~.
    0020: 00 00 00 00 00 00 18 01 7e e2 00 00 8a 8f 13 00 | ........~â..Š..
    0030: 61 11 06 02 ff ff ff ff ff ff 08 00 | a...ÿÿÿÿÿÿ..
    Ladies and gentlemen, take my advice, pull down your pants and slide on the ice.

    Comment

    • #17
      Kindness, check this out..

      Code Red Back For More - Slashdot
      http://slashdot.org/articles/01/08/05/0433219.shtml
      Brian Stretch writes: "The Code Red II worm was unleashed early this morning and appears to be very different than the original and far more dangerous. CR2 infected servers only attack servers within their Class A address block and their Class B address block in particular: since 9:11am EST I've l...


      You're being hit by code red II.

      Here are some links from another discussion board:

      Page Not Found - Motley Fool Community
      http://boards.fool.com/Message.asp?mid=15509785&sort=postdate
      Last edited by KvHagedorn; 6 August 2001, 22:42.

      Comment

      • #18
        Check www.grc.com

        Comment

        • #19
          I just got around to looking at my apache log - right now 2500 code red hits and counting

          Dan
          Juu nin to iro


          English doesn't borrow from other languages. It follows them down dark alleys, knocks them over, and goes through their pockets for loose grammar.

          Comment

          • #20
            With Verizon DSL here and this mess all started on Aug 1st... I must have had at least 10,000+ hits
            and rapidly increasing!
            "Be who you are and say what you feel, because those who mind don't matter, and those who matter don't mind." -- Dr. Seuss

            "Always do good. It will gratify some and astonish the rest." ~Mark Twain

            Comment

            • #21
              hmmm... that's weird... you guys seem to be hit far worse than me by the code red stuff.

              I just checked my apache logs:
              Code:
                      - 29 July: 0 attacks
29 July - 5 Aug  : 92 Code Red, 1 '2nd Generation Code Red 
5 Aug   - 8 Aug  : 30 Code Red, 67 2nd Generation Code Red

              Comment

              • #22
                From exactly 8 pm last night to right now (5:56 am) I have gotten 364 hits on the Zone alarm. That's a little over one hit every 2 minutes. Really strange.

                (The artist formerly known as Kindness!)

                Comment

                • #23
                  Most that are spreading this CodeRed crap are running Win2K server and in my instance, those with VerizonDSL are causing a major headache because the use of servers and VPN is allowed.

                  Call 1-877-222-2375 go through the options to reach support and just prior to reaching them there is a speal on CodeRed
                  "Be who you are and say what you feel, because those who mind don't matter, and those who matter don't mind." -- Dr. Seuss

                  "Always do good. It will gratify some and astonish the rest." ~Mark Twain

                  Comment

                  Previous 1 2 template Next
                  Working...
                  X