spoofs

gabsik · 09-12-2006, 08:20 AM

Code:

Sep 12 12:54:27 argo BOGON_SPOOF: IN=eth0 OUT= MAC=00:40:f4:7a:58:25:00:09:5b:b0:3c:a2:08:00  SRC=172.16.175.247 DST=192.168.0.2 LEN=60 TOS=00 PREC=0x00 TTL=47 ID=53445 CE DF PROTO=TCP SPT=36110 DPT=9091 SEQ=3315513394 ACK=0 WINDOW=5840 SYN URGP=0

As you see the ip trying to connect to my tor server is a reserverd one (172.16.0.0/12) because i have plenty of it in my iptables logs is anything more i can do to prevent this ?
Thanks !

unSpawn · 09-12-2006, 02:21 PM

As you see the ip trying to connect to my tor server is a reserverd one (172.16.0.0/12)
No it ain't a reserved one.

gabsik · 09-13-2006, 09:57 AM

To me it looks like a IANA reserverd address:
http://www.iana.org/assignments/ipv4-address-space
Or to this one :http://www.completewhois.com/bogons/...s-cidr-all.txt

unSpawn · 09-13-2006, 12:50 PM

Hmm. I'm pretty use I saw some spanish ISP nfo, but OK, I spose I queried for the wrong IP or whatever...

anything more i can do to prevent this
Prevent you can't, but since this hit your BOGON_SPOOF chain whatever limiting the chain does (-j DROP I hope) should do.

gabsik · 09-13-2006, 06:32 PM

Well usually worms in their DOS (?) broadcasts spoof their source address ... i have got to TARPIT them ... (P.O.M. way !)