Kollege
tiefer vogel
Da sitz ich gerade vorm Rechner... und wundere mich gerade woher denn der ganze Traffic kommt. Exakt 21Kb/s.
Per Wireshark die Ip herausgefunden, whois abgefragt....
Die Pakete von denen sehen etwa so aus:
Mein Download beträgt wenns hoch kommt ca 42Kb/s, so ist mein Zugang zum Netz halb unbrauchbar... Allerdings wundert mich auch, dass der traffic über meine VPN - IP gesandt wird. Ich denke mir, spinnen die Jungs? Das ist mein Provider!! Was treiben die da? Habe dann per iptables diese ip geblockt, voila! Noch schnell ne Beschwerde-Mail wegen DOS-Angriff an abuse@t-ipnet...
Was haltet ihr davon???
Bei Bedarf kann ich den gesamten aufgezeichneten Traffic liefern.
mfgeorg
Per Wireshark die Ip herausgefunden, whois abgefragt....
Code:
root baba # whois 84.187.226.11
% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html
% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '84.136.0.0 - 84.191.255.255'
inetnum: 84.136.0.0 - 84.191.255.255
netname: DTAG-DIAL20
descr: [B]Deutsche Telekom AG[/B]
country: DE
admin-c: DTIP
tech-c: DTST
status: ASSIGNED PA
remarks: ******************************************************************
remarks: * Abuse Contact: http://www.t-com.de/ip-abuse in case of Spam, *
remarks: * Hack Attacks, Illegal Activity, Violation, Scans, Probes, etc. *
remarks: ******************************************************************
mnt-by: DTAG-NIC
source: RIPE # Filtered
person: DTAG Global IP-Addressing
address: Deutsche Telekom AG
address: D-90492 Nuernberg
address: Germany
phone: +49 180 5334332
fax-no: +49 180 5334252
e-mail: ripe.dtip@telekom.de
nic-hdl: DTIP
mnt-by: DTAG-NIC
source: RIPE # Filtered
person: Security Team
address: Deutsche Telekom AG
address: Germany
phone: +49 180 5334332
fax-no: +49 180 5334252
e-mail: abuse@t-ipnet.de
nic-hdl: DTST
mnt-by: DTAG-NIC
source: RIPE # Filtered
% Information related to '84.128.0.0/10AS3320'
route: 84.128.0.0/10
descr: Deutsche Telekom AG, Internet service provider
origin: AS3320
member-of: AS3320:RS-PA-TELEKOM
mnt-by: DTAG-RR
source: RIPE # Filtered
Die Pakete von denen sehen etwa so aus:
Code:
No. Time Source Destination Protocol Info
2011 67.984148 80.237.156.90 1.0.0.2 TCP 12690 > 51741 [PSH, ACK] Seq=1084650 Ack=0 Win=1448 Len=360 TSV=3055333665 TSER=4342818
Frame 2011 (426 bytes on wire, 426 bytes captured)
Ethernet II, Src: ca:68:11:ff:dd:37 (ca:68:11:ff:dd:37), Dst: 00:ff:0d:11:51:92 (00:ff:0d:11:51:92)
Internet Protocol, Src: 80.237.156.90 (80.237.156.90), Dst: 1.0.0.2 (1.0.0.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
Total Length: 412
Identification: 0x026c (620)
Flags: 0x04 (Don't Fragment)
Fragment offset: 0
Time to live: 57
Protocol: TCP (0x06)
Header checksum: 0x4fa7 [correct]
Source: 80.237.156.90 (80.237.156.90)
Destination: 1.0.0.2 (1.0.0.2)
Transmission Control Protocol, Src Port: 12690 (12690), Dst Port: 51741 (51741), Seq: 1084650, Ack: 0, Len: 360
Source port: 12690 (12690)
Destination port: 51741 (51741)
Sequence number: 1084650 (relative sequence number)
[Next sequence number: 1085010 (relative sequence number)]
Acknowledgement number: 0 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
Window size: 1448
Checksum: 0xe3a7 [correct]
Options: (12 bytes)
Data (360 bytes)
0000 ec ad 20 93 8f 15 68 a4 a1 da 9e 9e 70 67 ba 68 .. ...h.....pg.h
0010 f3 17 93 0d 52 45 45 34 50 5a 96 8a 46 ac ad 6c ....REE4PZ..F..l
0020 a5 a0 e6 fa 8d 99 f4 a6 03 d8 d9 a0 40 81 58 e0 ............@.X.
0030 02 13 07 78 6a 95 9e 9b b0 b9 de ed 47 6d fb 94 ...xj.......Gm..
0040 4a 02 63 12 29 22 93 75 e6 17 08 31 11 2a d6 fe J.c.)".u...1.*..
0050 87 9f 62 69 0b 91 6d 68 a8 05 4b 3f 8a c1 23 2a ..bi..mh..K?..#*
0060 93 a2 e7 5b b2 8f a2 b1 dc 17 82 2d ea 26 5e d6 ...[.......-.&^.
0070 20 e7 7d 3d 14 cd 3f 37 d9 2c a8 d3 d9 37 d4 6a .}=..?7.,...7.j
0080 91 ed 3f ac 6b be 86 3a 2d d3 2e c2 7f 45 34 12 ..?.k..:-....E4.
0090 52 d2 34 42 91 b6 db 07 99 3d 07 d4 03 cd 9a 22 R.4B.....=....."
00a0 15 5d 35 53 13 48 03 74 78 b3 31 e8 fe 4d 35 6f .]5S.H.tx.1..M5o
00b0 08 91 4b f3 26 75 75 14 48 db d6 31 02 a4 2f a1 ..K.&uu.H..1../.
00c0 ac e1 63 0a 6f 60 24 83 f9 c7 22 4e 88 11 07 0e ..c.o`$..."N....
00d0 7f 53 e7 3a 29 a9 ba 95 31 50 5c b9 af 71 6c d9 .S.:)...1P\..ql.
00e0 51 d8 fb 26 f4 51 39 b3 ad 3b d2 88 a6 e8 ee ac Q..&.Q9..;......
00f0 fb 6a 8c ae fa 8e fc bb bf 4a b7 f4 a5 36 db 72 .j.......J...6.r
0100 2e f0 81 82 8f 18 ca 7e db f9 0e 61 5e 56 68 f0 .......~...a^Vh.
0110 f8 16 ea ca 26 05 ff 82 a4 bf c9 9f f9 01 00 ee ....&...........
0120 eb c4 81 01 3d 4f 96 2a db 6d 16 6c de 67 b9 35 ....=O.*.m.l.g.5
0130 8c e1 4f 61 dd 23 50 cd 79 93 8f 43 c5 5d f3 73 ..Oa.#P.y..C.].s
0140 2f 49 09 8e 46 55 22 7d 28 fa 37 a4 01 27 63 65 /I..FU"}(.7..'ce
0150 bf d5 78 9a 83 cc 1f 66 01 e6 94 8e 72 a9 ee e3 ..x....f....r...
0160 2b ff 20 aa 55 e7 19 7b +. .U..{
No. Time Source Destination Protocol Info
2012 67.984177 1.0.0.2 80.237.156.90 TCP 51741 > 12690 [ACK] Seq=0 Ack=1085010 Win=3358 Len=0 TSV=4342826 TSER=3055333650
Frame 2012 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:ff:0d:11:51:92 (00:ff:0d:11:51:92), Dst: ca:68:11:ff:dd:37 (ca:68:11:ff:dd:37)
Internet Protocol, Src: 1.0.0.2 (1.0.0.2), Dst: 80.237.156.90 (80.237.156.90)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
Total Length: 52
Identification: 0x83f9 (33785)
Flags: 0x04 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xc881 [correct]
Source: 1.0.0.2 (1.0.0.2)
Destination: 80.237.156.90 (80.237.156.90)
Transmission Control Protocol, Src Port: 51741 (51741), Dst Port: 12690 (12690), Seq: 0, Ack: 1085010, Len: 0
Source port: 51741 (51741)
Destination port: 12690 (12690)
Sequence number: 0 (relative sequence number)
Acknowledgement number: 1085010 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
Window size: 3358
Checksum: 0x19aa [correct]
Options: (12 bytes)
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 2011]
[The RTT to ACK the segment was: 0.000029000 seconds]
No. Time Source Destination Protocol Info
2013 68.026498 80.237.156.90 1.0.0.2 TCP 12690 > 51741 [ACK] Seq=1085010 Ack=0 Win=1448 Len=1308 TSV=3055333671 TSER=4342818
Frame 2013 (1374 bytes on wire, 1374 bytes captured)
Ethernet II, Src: ca:68:11:ff:dd:37 (ca:68:11:ff:dd:37), Dst: 00:ff:0d:11:51:92 (00:ff:0d:11:51:92)
Internet Protocol, Src: 80.237.156.90 (80.237.156.90), Dst: 1.0.0.2 (1.0.0.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
Total Length: 1360
Identification: 0x026e (622)
Flags: 0x04 (Don't Fragment)
Fragment offset: 0
Time to live: 57
Protocol: TCP (0x06)
Header checksum: 0x4bf1 [correct]
Source: 80.237.156.90 (80.237.156.90)
Destination: 1.0.0.2 (1.0.0.2)
Transmission Control Protocol, Src Port: 12690 (12690), Dst Port: 51741 (51741), Seq: 1085010, Ack: 0, Len: 1308
Source port: 12690 (12690)
Destination port: 51741 (51741)
Sequence number: 1085010 (relative sequence number)
[Next sequence number: 1086318 (relative sequence number)]
Acknowledgement number: 0 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
Window size: 1448
Checksum: 0x9294 [correct]
Options: (12 bytes)
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 2012]
[The RTT to ACK the segment was: 0.042321000 seconds]
Data (1308 bytes)
0000 ff fb 90 60 cd 80 03 97 3c 58 e9 f1 6a e8 4f 47 ...`....<X..j.OG
0010 7b 0d 60 e7 5b 0d 51 5d 61 a7 b4 ed a1 48 94 ec {.`.[.Q]a....H..
0020 a9 83 a1 6a 05 7c e0 c7 fa 83 1c bc 8a 54 4c 56 ...j.|.......TLV
0030 f9 c4 47 96 c5 3e 06 1a 3e be f1 61 1a f4 89 40 ..G..>..>..a...@
0040 9d 47 37 5c 01 18 1f 1b 7c 91 2c 51 bf 1f f7 15 .G7\....|.,Q....
0050 bf ee 90 b7 be c5 ce ed 5e 1c 8e 46 56 93 ee f9 ........^..FV...
0060 be e2 c5 4a 58 55 e9 01 a5 2e 87 83 cf 3f 2c 06 ...JXU.......?,.
0070 7a de 84 aa 76 bf de 44 96 d4 91 26 5c 6d a6 e1 z...v..D...&\m..
0080 7d 4b 3c 44 97 fa 05 85 56 7e de cc 2e 4c 99 cc }K<D....V~...L..
0090 80 70 12 8f ee 03 09 fd d1 72 54 5a 5d 5d 41 ff .p.......rTZ]]A.
00a0 f2 50 69 6a 61 71 83 ce ff c9 3e fe f6 14 8a e0 .Pijaq....>.....
00b0 4d c5 aa ec 72 07 3d f6 24 13 3a d7 4a bb 20 82 M...r.=.$.:.J. .
00c0 f1 af 93 0d 1d 87 28 4c e2 56 e1 67 96 58 85 e2 ......(L.V.g.X..
00d0 1a a4 eb a1 5b 3e 4d 14 9d 8e 16 a4 6d b6 d8 36 ....[>M.....m..6
00e0 c1 88 24 85 da 23 aa 0b a3 8c 66 3b 94 cf a2 26 ..$..#....f;...&
00f0 c3 44 e6 46 ab 3a 68 7b ac c8 10 40 de 31 75 3e .D.F.:h{...@.1u>
0100 41 cd cd e8 a8 cc e1 70 b1 8f a9 a2 71 28 be ae A......p....q(..
0110 78 2c 22 fe 50 91 fe e9 1c a0 5c bc a9 ee d9 bf x,".P.....\.....
0120 e8 c6 b5 0e 43 6e 73 1e ea 32 73 d6 54 6e ea a8 ....Cns..2s.Tn..
0130 ea a8 82 66 a6 d7 47 39 95 21 f5 dc f9 3f 53 ae ...f..G9.!...?S.
0140 f4 00 89 b5 20 42 49 22 a5 6a e5 18 2e f5 88 76 .... BI".j.....v
0150 92 ab 47 c7 e2 b0 43 8b 18 87 56 da c7 d2 ec fb ..G...C...V.....
0160 df a9 90 33 f9 52 ef dc a0 96 73 eb 38 5e 73 7b ...3.R....s.8^s{
0170 10 28 4a 41 41 47 b6 87 b6 b5 3c fd 78 0e 9a ad .(JAAG....<.x...
0180 73 e2 a3 bf 53 16 fa dc b8 42 45 45 4d a6 a6 07 s...S....BEEM...
0190 2c 73 69 56 4c 25 a4 aa 44 bd d5 58 ba 10 53 8d ,siVL%..D..X..S.
01a0 b1 ff fb 90 60 cc 80 03 7e 42 d7 61 ef 42 e8 5f ....`...~B.a.B._
01b0 05 3a fd 61 a8 5b 0d 4d 0d 63 a7 c8 eb a1 4e 8d .:.a.[.M.c....N.
01c0 eb f5 87 9d 24 19 17 a1 c8 1b 5b ac b4 d0 59 a3 ....$.....[...Y.
01d0 5a b8 e1 7f 50 11 c0 40 3e b1 a4 9e ec ec 82 d2 Z...P..@>.......
01e0 4e fa d6 16 63 cf d0 1e c5 d7 b2 b1 3e 2c 7d 25 N...c.......>,}%
01f0 d9 49 a8 c4 a7 41 ef ea 5f 74 94 b7 56 6f 51 8a .I...A.._t..VoQ.
0200 6e ba 56 1e e6 8d 44 cc dd 14 d1 6e a5 9f 6d 99 n.V...D....n..m.
0210 47 d9 e9 51 3e 45 c9 d6 72 61 e6 39 29 be c9 34 G..Q>E..ra.9)..4
0220 95 6b a6 80 4d 30 9c a8 f0 9a 62 85 95 de b3 59 .k..M0....b....Y
0230 d9 91 e3 c1 d6 a2 46 67 5c b8 56 1e a7 ff 50 53 ......Fg\.V...PS
0240 f1 06 6f 70 33 7c 40 0c bf 1a 4f a0 ba bd 07 44 ..op3|@...O....D
0250 61 c6 ff d9 4d 8e 15 6e ca 64 55 c9 69 29 19 41 a...M..n.dU.i).A
0260 fd 4e e9 be f5 fb 34 a5 1c 9e 42 8b 91 b6 e4 77 .N....4...B....w
0270 c7 96 cb 66 dd 4b 78 a4 bb f3 3d 85 dc b3 9e 0a ...f.Kx...=.....
0280 c2 96 54 86 44 f5 2c 0d 40 a9 57 a0 56 37 3b 59 ..T.D.,.@.W.V7;Y
0290 6b 1f 89 4f 5a 00 1a 07 9a 8d 30 13 2e e8 7d 4a k..OZ.....0...}J
02a0 01 57 bf 3c f3 f0 6d 47 5f f6 7e d3 47 1b 14 58 .W.<..mG_.~.G..X
02b0 74 b9 99 8a 82 90 63 50 6c 71 e3 af 74 3e 68 a4 t.....cPlq..t>h.
02c0 b6 73 ca 9b d7 98 df 8d b9 2d 5b 90 d0 7b fa e2 .s.......-[..{..
02d0 77 4e 17 76 89 74 49 6b 36 40 72 59 6e 00 d8 f8 wN.v.tIk6@rYn...
02e0 07 a0 92 5b 34 b0 42 a3 74 58 b0 46 eb a4 b7 26 ...[4.B.tX.F...&
02f0 8a cd f3 86 bf 8a bf 52 ac cb ab 80 08 7e b9 50 .......R.....~.P
0300 44 fd 19 54 59 a3 e6 8d fb ff ff 6a 3f 21 30 f1 D..TY......j?!0.
0310 1b c0 75 5b 42 91 d9 db ce 74 80 25 24 b3 6d d5 ..u[B....t.%$.m.
0320 3d 5b f1 c8 27 cd b1 5c a1 87 ea 0d fe 74 fb 70 =[..'..\.....t.p
0330 05 9c 48 3c cf 25 03 14 a5 aa 5d 1c e0 1b 99 6c ..H<.%....]....l
0340 f2 f5 ff fb 90 60 c4 80 03 34 46 d9 61 ed 6a e8 .....`...4F.a.j.
0350 47 a4 cb 3d 61 65 4b 0d cd 71 67 ac 34 ed a1 12 G..=aeK..qg.4...
0360 9a ac b5 16 9d 68 11 e6 4b 65 32 28 98 0f 3e 82 .....h..Ke2(..>.
0370 61 f9 06 9a f0 a1 24 d3 50 6a 6d f8 e6 a4 54 17 a.....$.Pjm...T.
0380 bd e5 bc ff ab 58 8c b5 45 97 cf c8 42 ff 9c f5 .....X..E...B...
0390 1e 56 fa 96 d9 ac 85 ff b6 bc af f5 e4 35 f4 c4 .V...........5..
03a0 9c 97 44 99 24 19 db 48 94 8a 49 59 20 f4 02 a3 ..D.$..H..IY ...
03b0 a5 cb f5 95 ad ea 84 f9 81 b8 90 23 b4 ea 9c c0 ...........#....
03c0 63 bf b2 40 ef 7f d3 7f 44 76 b6 ac e8 68 2f 7d c..@....Dv...h/}
03d0 11 cc 7f 5f 3a ad fa 5a d2 ff d6 fe bb 27 40 bc ..._:..Z.....'@.
03e0 d5 27 cc 15 52 2f be b6 ea e7 b9 0e ce 7f 9e e7 .'..R/..........
03f0 e7 af 5d 4e 53 d5 d6 4b 46 58 d2 5a bb f6 88 3c ..]NS..KFX.Z...<
0400 55 53 92 e7 23 b8 cc 24 5d c6 6b 0b 75 40 21 92 US..#..$].k.u@!.
0410 ec c6 89 ca 82 f5 ba e8 04 18 1d 11 76 ec 2f 5b ............v./[
0420 ac c4 8d 56 71 46 42 b3 f5 28 68 35 d3 55 61 75 ...VqFB..(h5.Uau
0430 6a f5 46 f6 66 1b 50 98 90 1b 65 5c f5 ba d3 3d j.F.f.P...e\...=
0440 95 f2 75 ab 7a c8 0f 73 14 97 2f aa 9a 14 ca 8b ..u.z..s../.....
0450 14 b7 46 ee 6d df 73 d9 d6 d6 ff 52 9e a2 4b ab ..F.m.s....R..K.
0460 bf 7e 7b 92 fa 49 60 4d 1a 20 24 52 4a 20 02 3a .~{..I`M. $RJ .:
0470 03 03 b9 19 f5 af f6 d8 fb 70 80 0a a2 52 ec a9 .........p...R..
0480 90 e0 df 51 34 4d 96 af ab f2 2b 77 41 31 a8 10 ...Q4M....+wA1..
0490 d7 50 34 cf b1 4f cd 2c d8 b3 47 fd 5f bd df 52 .P4..O.,..G._..R
04a0 ad 42 0f be 9e da ff 43 7b 72 df a7 f3 7a 72 bb .B.....C{r...zr.
04b0 2c bb 5b 94 e5 75 80 21 99 6a 48 94 91 49 28 2b ,.[..u.!.jH..I(+
04c0 41 6e 40 21 9c f0 3a 1c a2 76 f1 6d b3 70 02 d0 An@!..:..v.m.p..
04d0 6c d7 d4 15 e6 ea 67 b9 e0 06 89 63 de b1 98 70 l.....g....c...p
04e0 db cb e4 ff fb 90 60 d2 00 03 25 54 d8 e1 f3 53 ......`...%T...S
04f0 68 53 48 6b 1d 61 ad 5d 0d cd 73 63 8c 35 ad a1 hSHk.a.]..sc.5..
0500 43 a9 ac 74 f6 9d b4 15 6b 51 50 49 c0 ea 53 30 C..t....kQPI..S0
0510 2e 9f 6a a0 2f 73 f5 24 9d 3f 41 aa ..j./s.$.?A.
Mein Download beträgt wenns hoch kommt ca 42Kb/s, so ist mein Zugang zum Netz halb unbrauchbar... Allerdings wundert mich auch, dass der traffic über meine VPN - IP gesandt wird. Ich denke mir, spinnen die Jungs? Das ist mein Provider!! Was treiben die da? Habe dann per iptables diese ip geblockt, voila! Noch schnell ne Beschwerde-Mail wegen DOS-Angriff an abuse@t-ipnet...
Was haltet ihr davon???
Bei Bedarf kann ich den gesamten aufgezeichneten Traffic liefern.
mfgeorg