Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
| Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
06-20-2006, 09:57 PM
|
#1
|
|
LQ Newbie
Registered: Mar 2003
Location: VN
Distribution: Linux7.1,7.3
Posts: 12
Rep: 
|
how block this traffic
Hi,
i saw many traffic from many ip like below while using tcpdump
09:50:02.177663 125.235.119.186 > myhost: icmp: 125.235.119.186 udp port 1231 unreachable (DF)
09:50:02.179520 125.235.131.156 > myhost: icmp: 125.235.131.156 udp port 1231 unreachable (DF)
What is this traffic and how can i block it?
Thanks & best regards
|
|
|
|
|
06-20-2006, 11:32 PM
|
#2
|
|
Senior Member
Registered: Sep 2003
Posts: 3,171
Rep: 
|
If your NIC is in promiscuous mode, then you are seeing all traffic that is on your wire, whether it is directed at you or not. If the traffic is directed at you then the only way to block it is to put a firewall appliance between your computer and the internet.
|
|
|
|
|
06-21-2006, 12:56 AM
|
#3
|
|
Member
Registered: Mar 2004
Posts: 135
Rep:
|
Quote:
|
Originally Posted by echox
Hi,
i saw many traffic from many ip like below while using tcpdump
09:50:02.177663 125.235.119.186 > myhost: icmp: 125.235.119.186 udp port 1231 unreachable (DF)
09:50:02.179520 125.235.131.156 > myhost: icmp: 125.235.131.156 udp port 1231 unreachable (DF)
What is this traffic and how can i block it?
Thanks & best regards
|
It shows that your host send a UDP packet to 125.235.119.186 at port 1231. However, that port is not open at 125.235.119.186. So 125.235.119.186 sent back an ICMP message telling you that that port is unreachable. |
|
|
|
|
06-21-2006, 04:25 AM
|
#4
|
|
LQ Newbie
Registered: Mar 2003
Location: VN
Distribution: Linux7.1,7.3
Posts: 12
Original Poster
Rep:
|
Quote:
|
Originally Posted by fedora4002
It shows that your host send a UDP packet to 125.235.119.186 at port 1231. However, that port is not open at 125.235.119.186. So 125.235.119.186 sent back an ICMP message telling you that that port is unreachable.
|
my host is send bad traffic, isn't it? Myhost is a DNS server, only tcp and udp package comming on port 53. |
|
|
|
|
06-21-2006, 04:46 AM
|
#5
|
|
Senior Member
Registered: Sep 2005
Location: Out
Posts: 3,307
Rep:
|
my guess would be that your dns is answer too slow compared to the time that the requester closes its port (firewall or ip stack)
You need the complete icmp message to see if source port was 53/udp
|
|
|
|
|
06-21-2006, 11:21 PM
|
#6
|
|
Member
Registered: Mar 2004
Posts: 135
Rep:
|
it is also possible that someone spoof these traffic.
|
|
|
|
All times are GMT -5. The time now is 06:04 PM.
|
|
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
|
 Latest Threads
LQ News
|
|
