Search squid archive

Re: lots of UDP connections

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Bal Krishna Adhikari 6/3/2011 6:13 AM

Hello,

I found a lot of UDP connections that is coming to my proxy servers.
I don't find the cause of such one-way traffics to my servers.
The sample UDP traffic is as :-

14:00:07.506612 IP 41.209.69.146.10027>  x.x.x.x.65453: UDP, length 30
14:00:07.518118 IP 121.218.37.254.41597>  x.x.x.x.64338: UDP, length
30
14:00:07.572559 IP 85.224.143.193.29978>  x.x.x.x.62782: UDP, length
30
14:00:07.596554 IP 183.87.200.42.36895>  x.x.x.x.15786: UDP, length 30
14:00:07.642820 IP 180.215.37.96.49977>  x.x.x.x.49458: UDP, length 30
14:00:07.653055 IP 117.195.138.64.24314>  x.x.x.x.44985: UDP, length
33
14:00:07.739963 IP 82.31.238.101.50534>  x.x.x.x.52750: UDP, length 30
14:00:07.783452 IP 86.83.107.196.41870>  x.x.x.x.62782: UDP, length 30
14:00:07.809677 IP 94.246.23.15.59003>  x.x.x.x.27462: UDP, length 30
14:00:07.837415 IP 75.156.164.147.49398>  x.x.x.x.34847: UDP, length
30
14:00:07.841668 IP 82.8.212.242.25931>  x.x.x.x.24869: UDP, length 30
14:00:07.841697 IP 89.136.112.99.42182>  x.x.x.x.52750: UDP, length 30
14:00:07.854215 IP 99.191.156.208.18162>  x.x.x.x.64338: UDP, length
30
14:00:07.885386 IP 88.147.72.252.60224>  x.x.x.x.19151: UDP, length 30
14:00:07.960841 IP 68.169.185.192.63480>  x.x.x.x.58638: UDP, length
30
14:00:08.071763 IP 79.113.242.42.31998>  x.x.x.x.33995: UDP, length 30
14:00:08.078260 IP 94.202.49.109.61957>  x.x.x.x.26071: UDP, length 67
14:00:08.101495 IP 82.169.68.179.19605>  x.x.x.x.45682: UDP, length 30
14:00:08.113238 IP 86.99.42.7.15086>  x.x.x.x.11706: UDP, length 67
14:00:08.127979 IP 62.195.70.253.45266>  x.x.x.x.37050: UDP, length 30
14:00:08.163992 IP 2.82.207.195.38343>  x.x.x.x.26680: UDP, length 30
14:00:08.183453 IP 68.81.206.57.25923>  x.x.x.x.18378: UDP, length 30
14:00:08.237689 IP 108.120.241.254.47249>  x.x.x.x.39433: UDP, length
30
14:00:08.256906 IP 99.161.157.254.41719>  x.x.x.x.26680: UDP, length
30
14:00:08.291885 IP 121.136.175.247.12577>  x.x.x.x.16485: UDP, length
67
14:00:08.315427 IP 121.144.158.120.30845>  x.x.x.x.61415: UDP, length
30
14:00:08.317404 IP 115.117.219.18.25817>  x.x.x.x.59936: UDP, length
30

Anyone has any idea if the traffic is genuine or some kind of attack ?
x.x.x.x is my proxy server.

--- Bal Krishna


On 04/06/11 01:16, Chad Naugle wrote:
> Check the hostname of these IP addresses.  They could be DNS replies,
> using random ports for source/destinations.  Squid can generate tons of
> DNS traffic.


I don't think its genuine Squid traffic. DNS, ICP and HTCP all use a fixed well-known port at one end and a rarely changing port at the other.

It could be anything else on the box though.

There are a few CVE attacks this could be, two using DNS and one HTCP.
If you have a Squid 2.7.STABLE8+, 3.0.STABLE23+ or 3.1.1+ you are safe from those. They are just annoying.

If you have a Squid-3.1+ with an IPv6 address publicly advertised this could be a sign of v6 connection attempts. Several IP tunnel protocols involve UDP handshakes.

Amos
--
Please be using
  Current Stable Squid 2.7.STABLE9 or 3.1.12
  Beta testers wanted for 3.2.0.8 and 3.1.12.2


[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux