spoof hitting port 1026

gabsik · 09-03-2006, 10:41 PM

i have this anti-spoof rule in iptables :

Code:

cat /root/bogon-bn-nonagg.txt |\
egrep -ve "(^127\.|^192\.168\.|^41\.|^73\.|^76\.|^89\.|^90\.|^121\.|^122\.|^123\.\
|^124\.|^125\.|^126\.|^189\.| ^190\.)"|while read s; do
 /sbin/iptables -t nat -I PREROUTING -i eth0 -s $s -j DROP
 /sbin/iptables -t nat -I PREROUTING -i eth0 -s $s -j ULOG --ulog-prefix 'BOGON_SPOOF:'
done

And i have found many of these logs:

Code:

Sep  2 13:15:07 argo BOGON_SPOOF: IN=eth0 OUT= MAC=00:40:f4:7a:58:25:00:09:5b:b0:3c:a2:08:00  SRC=180.193.136.244 DST=192.168.0.2 LEN=519 TOS=00 PREC=0x00 TTL=54 ID=17219 PROTO=UDP SPT=31242 DPT=1026 LEN=499

As you see it's hitting port 1026 and they are all i say all hitting port 1026 what couuld it mean ?

Code:

cat /etc/services | grep 1026

doesn't give me anything should i be worried ?
Thanx!

anomie · 09-04-2006, 12:36 AM

Read here: http://www.grc.com/port_1026.htm

And here: http://isc.sans.org/port_details.php?port=1026

gabsik · 09-04-2006, 01:49 AM

Thanks for the links but still i don't get why the ip is a IANA one

Code:

Since this is UDP, the spammers forge the source IP address to some unsuspecting party.  Do not trust the source address, the packets would have to be traced hop by hop

This might be why !

Capt_Caveman · 09-04-2006, 11:43 PM

Often these arise from virus-infected Windows machines either on your LAN (if you have one) or from machines that belong to other suscribers of your ISP and are within the last hop. Technically these likely should be filtered but often aren't until the upstream router.