Our kernel log (the one that logs packet filter hits) recently grew to 60Mb for one day. As I was looking through it I could see hundreds of thousands of entries that basically look like this:
They scan through almost every port known to man. Now the interesting thing is this:
* the source IP is probably forged because it varies throughout the attack across wildly different networks. It is constant for about a thousand entries (over say 2 seconds) and then changes to another IP.
* the destination IP is constant throughout the whole attack. BUT THE DESTINATION HAS NOTHING TO DO WITH US! We are in Australia, the destination IP resolves to Sweden. I can see how any route would cause those packets to get to us.
Is ASL reporting the wrong IP? Is this attacker clever enough to fool ASL?
This thread was automatically locked due to age.
