Spt 500 Dpt 500

gabsik · 11-12-2006, 05:38 AM

i often find this in my firewall logs :

Code:

ov 12 03:09:01 argo UDP: IN=eth0 OUT= MAC=00:40:f4:7a:58:25:00:09:5b:b0:3c:a2:08:00  SRC=81.37.223.56 DST=192.168.0.2 LEN=304 TOS=00 PREC=0x00 TTL=115 ID=6520 PROTO=UDP SPT=500 DPT=500 LEN=284
Nov 12 03:09:01 argo UDP: IN=eth0 OUT= MAC=00:40:f4:7a:58:25:00:09:5b:b0:3c:a2:08:00  SRC=81.37.223.56 DST=192.168.0.2 LEN=304 TOS=00 PREC=0x00 TTL=115 ID=6575 PROTO=UDP SPT=500 DPT=500 LEN=284
Nov 12 03:09:07 argo UDP: IN=eth0 OUT= MAC=00:40:f4:7a:58:25:00:09:5b:b0:3c:a2:08:00  SRC=81.37.223.56 DST=192.168.0.2 LEN=304 TOS=00 PREC=0x00 TTL=115 ID=7070 PROTO=UDP SPT=500 DPT=500 LEN=284
Nov 12 03:09:15 argo UDP: IN=eth0 OUT= MAC=00:40:f4:7a:58:25:00:09:5b:b0:3c:a2:08:00  SRC=81.37.223.56 DST=192.168.0.2 LEN=304 TOS=00 PREC=0x00 TTL=115 ID=7555 PROTO=UDP SPT=500 DPT=500 LEN=284
Nov 12 03:09:31 argo UDP: IN=eth0 OUT= MAC=00:40:f4:7a:58:25:00:09:5b:b0:3c:a2:08:00  SRC=81.37.223.56 DST=192.168.0.2 LEN=304 TOS=00 PREC=0x00 TTL=115 ID=8839 PROTO=UDP SPT=500 DPT=500 LEN=284

.. but now it's too much i also went to dshield but i did not find much any help ?
thanks!

chort · 11-12-2006, 06:32 AM

That's the port typically used by the key negotiation component of IPSec. Someone is probably looking for a misconfigured or exploitable VPN configuration.

gabsik · 11-12-2006, 03:07 PM

Thanks that's what i found too !