Firewall UDP ? Attack !! Or Normal ?
-
@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:
@silence could you please PM me (send me a private message) Click my avatar and start conversation. With what you actual IP is - I would like to look up the ptr for it, and other info I can glean from this IP. Also are you saying this vpn2.med.com.do is suppose to point to your real IP, and its pointing to some other IP..
I did stop for a few beers tonight with buddy - so that might be my problem, but still confused about your traces and what is suppose to point to what from a fqdn or ptr point of view ;)
If your seeing 33Mbps to your IP no matter what the port is from just "noise" that seems excessive for sure. But as others have mentioned - when some ISP gives you an IP - it could come with baggage. You don't know what that IP was used for in the past, and you could have other users or companies still trying to hit it, etc. that other port 33224 is that udp or tcp - that is unassigned.. It's not a port actually assigned to anything specific.. So yeah that is odd traffic for sure. But that 200.88 IP is a do (CompañÃa Dominicana de TelÃ
fonos S. A) IP.. Which at least the region of the world I believe your in.Done.
-
@silence I do not see how the PTR would be cause of the traffic. What seems likely is they use to have your old IP.. They changed it at some point, but never got the PTR removed..
But they still have something pointing to this old IP (now your IP) vs using the fqdn, if they used the fqdn they would point to what that forward points too
;; ANSWER SECTION:
vpn2.med.com.do. 3150 IN A 179.51.66.42Its prob a good thing that the PTR was not updated, because it gives you a clue to why the traffic is still being sent to your IP.
I would contact the domain owners for med.com.do - they might be able to help get their customers/clients/whoever might be pointing to that old IP (now your ip).
-
@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:
I would contact the domain owners for med.com.do
Done.
-
@silence Or could be when the ISP was changing the PTRs on the IP they F'd it up and put it on yours vs where it was suppose to go..
And this med.com.do never had anything to ever with your IP..
But will be interesting if you hear from them.. Let us know..
-
@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:
Or could be when the ISP was changing the PTRs on the IP they F'd it up and put it on yours vs where it was suppose to go..
And this med.com.do never had anything to ever with your IP..
But will be interesting if you hear from them.. Let us know..Yes, I am trying to get in contact with the owner of med.com.do and with my isp, I will keep this thread informed, because whatever this is it does cause a problem.
-
@silence I do show the current PTR for where that vpn2 fqdn points to be set..
;; QUESTION SECTION:
;42.66.51.179.in-addr.arpa. IN PTR;; ANSWER SECTION:
42.66.51.179.in-addr.arpa. 38400 IN PTR vpn2.med.com.do. -
@silence said in Firewall UDP ? Attack !! Or Normal ?:
@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:
Or could be when the ISP was changing the PTRs on the IP they F'd it up and put it on yours vs where it was suppose to go..
And this med.com.do never had anything to ever with your IP..
But will be interesting if you hear from them.. Let us know..Yes, I am trying to get in contact with the owner of med.com.do and with my isp, I will keep this thread informed, because whatever this is it does cause a problem.
I did a "Who Is" on that domain and it reports them as a banking and finance operation in Santo Domingo, Dominican Republic. Perhaps they changed ISPs or IPs, and still have a misconfigured device trying to establish a site-to-site VPN or something ?? Or perhaps it's a way for their customers to connect with them and someone didn't get the word on a new IP.
-
@bmeeks said in Firewall UDP ? Attack !! Or Normal ?:
them and someone didn't get the word on a new IP.
Yeah you would think this - but clearly that would not be working, so you would think someone would notice something not working ;)
-
@johnpoz said in Firewall UDP ? Attack !! Or Normal ?:
so you would think someone would notice something not working ;)
I keep aiming for an attack, because really, how is it possible for someone to keep trying the same port every day and realize they don't get a response but still continue... unless they want to do it on purpose?
-
@silence said in Firewall UDP ? Attack !! Or Normal ?:
I keep aiming for an attack, because really, how is it possible for someone to keep trying the same port every day and realize they don't get a response but still continue... unless they want to do it on purpose?
Why would someone "waste" 33Mbit/s bw on attacking you ?
-
@bingo600 said in Firewall UDP ? Attack !! Or Normal ?:
Why would someone "waste" 33Mbit/s bw on attacking you ?
I don't know, I'm just trying to understand what's going on...and why I can't use my IP xD
-
@silence said in Firewall UDP ? Attack !! Or Normal ?:
@bingo600 said in Firewall UDP ? Attack !! Or Normal ?:
Why would someone "waste" 33Mbit/s bw on attacking you ?
I don't know, I'm just trying to understand what's going on...and why I can't use my IP xD
Don't focus too much on it being an attack. It really does appear more likely to be a misconfigured box somewhere else pointing to what is now the "wrong IP" for some data path. And because the traffic is UDP, the sender will have no idea the data is not getting where he wants it. He will just keep sending what he was set up to send. And with UDP that is by design -- the sender just "assumes" the data got there. And by "he", I don't mean a human. I'm thinking a dumb device like maybe a dedicated point-to-point hardware device.
So assuming somebody once had a device configured to send a set of data via UDP to the IP you now have, if that device was not reconfigured to the new IP, it would still be streaming the same stuff to the old IP. Now, like @johnpoz said earlier, you would think someone at the other end of the session would notice things were not right and look into it. But who knows ???
-
@bmeeks
Yes, very that
The issue will be over if this 'some one' will finally check the logs of his / this device, understand that some cron (?) task somewhere is using hard coded IP or domain name, and it fails now, or at least doesn't do what it should be doing.
He will update his stuff, and the issue will be gone. -
@bmeeks said in Firewall UDP ? Attack !! Or Normal ?:
I don't mean a human.
Totally agree with you, the only problem is because from so many different IPs?
-
@bingo600 @bmeeks @Gertjan @johnpoz @SteveITS
Guys, I bring you a new update, about the case...
During the weekend I am not in the office and I usually have some alerts that help me monitor the service remotely.
Well, this alert appears during Saturday morning.
Today I go back to the office, and when I check my wan (it doesn't work) for some reason it's as if my isp has disconnected me completely. (I already sent the report to my isp and they are evaluating the situation)
but this confirms once again that something is not right in that wan.
-
@silence said in Firewall UDP ? Attack !! Or Normal ?:
Today I go back to the office, and when I check my wan (it doesn't work) for some reason it's as if my isp has disconnected me completely. (I already sent the report to my isp and they are evaluating the situation)
but this confirms once again that something is not right in that wan.Huh? Causality vs. correlation. Because you seem to have strange traffic and now your ISP supposedly has cut you off that confirms anything? That's no troubleshooting or debugging, that is pure guessing and crystal ball reading
I'd check my ISP first to confirm that sth. was amiss on my line and that's why they disconnected me. Could also be just a faulty uplink, problem with the ISP itself etc. etc. All other things are just guesses and no evidence there's something not right on your WAN.
Cheers
-
@bingo600 @bmeeks @Gertjan @JeGr @johnpoz @SteveITS Updates:
Another ip range and another port equal to udp directed to my wan.
I don't want to hear the obvious, I ignore this kind of traffic alright, but what I'm looking for is to come to a conclusion, what are they trying to do?
If anyone has anything, I'm open to hearing.
-
@silence well 2096 is NBX-DIR, what that is used for - not sure.. cpanel something most likely from the info given here
https://www.speedguide.net/port.php?port=2096
-
@silence
Haha u r being hacked cuz of a misconfiguration of your firewall
Ok fair...
So now where are is the rulset and what services r u providing behind your firewallBR
NoPlan -
@noplan but........
The traffic's being..............blocked?
