<div dir="ltr">Scott,<br><br>What I do to pinpoint traffic identification is run a
software based firewall. I personally use FreeBSD and IPFilter.
However, Linux has options too. In any event, I log all traffic
blocked and then I can determine what ports are being targeted. Once I
have port numbers than I can lookup (via google of course) what
activity normally uses the port(s). In a lot of case I usally find
windows based exploits.<br>
<br>I have even taken this a step further when unpermitted traffic is
high, say many attempts to hit my port 22. I then send an email to the
network's abuse address and inform them about the issue.<br><br>I get at least one denied packet per minute and sometimes several packets a minute. I sometimes see port walking too.<br>
<br>Good luck,<br>John<br><br><div class="gmail_quote">On Wed, Sep 3, 2008 at 5:30 PM, Scott Castaline <span dir="ltr"><<a href="mailto:hscast@charter.net">hscast@charter.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
I've suddenly noticed a very high level of activity on my broadband<br>
connection. When I view the logs on my router one IP sticks out,<br>
<a href="http://24.64.254.20" target="_blank">24.64.254.20</a>. nslookup gives: Non-authoritative answer:<br>
20.254.64.24.in-addr.arpa name = <a href="http://S010600161726dd6b.cg.shawcable.net" target="_blank">S010600161726dd6b.cg.shawcable.net</a>.<br>
<br>
Authoritative answers can be found from:<br>
254.64.24.in-addr.arpa nameserver = <a href="http://ns1.so.cg.shawcable.net" target="_blank">ns1.so.cg.shawcable.net</a>.<br>
254.64.24.in-addr.arpa nameserver = <a href="http://ns2.so.cg.shawcable.net" target="_blank">ns2.so.cg.shawcable.net</a>.<br>
<br>
And tracert gives:<br>
<br>
> [root@ncc1701f ~]# tracert <a href="http://24.64.254.20" target="_blank">24.64.254.20</a><br>
> traceroute to <a href="http://24.64.254.20" target="_blank">24.64.254.20</a> (<a href="http://24.64.254.20" target="_blank">24.64.254.20</a>), 30 hops max, 40 byte packets<br>
> 1 <a href="http://192.168.11.1" target="_blank">192.168.11.1</a> (<a href="http://192.168.11.1" target="_blank">192.168.11.1</a>) 0.469 ms 0.601 ms 0.755 ms<br>
> 2 <a href="http://10.226.128.1" target="_blank">10.226.128.1</a> (<a href="http://10.226.128.1" target="_blank">10.226.128.1</a>) 9.591 ms 9.616 ms 9.771 ms<br>
> 3 <a href="http://172.26.102.197" target="_blank">172.26.102.197</a> (<a href="http://172.26.102.197" target="_blank">172.26.102.197</a>) 9.766 ms 9.906 ms 10.024 ms<br>
> 4 <a href="http://24-197-160-34.static.gwnt.ga.charter.com" target="_blank">24-197-160-34.static.gwnt.ga.charter.com</a> (<a href="http://24.197.160.34" target="_blank">24.197.160.34</a>) 10.808 ms 10.810 ms 11.011 ms<br>
> 5 <a href="http://so-7-0-0.edge2.Atlanta2.Level3.net" target="_blank">so-7-0-0.edge2.Atlanta2.Level3.net</a> (<a href="http://4.78.63.9" target="_blank">4.78.63.9</a>) 16.032 ms 16.030 ms 16.152 ms<br>
> 6 <a href="http://ae-72-52.ebr2.Atlanta2.Level3.net" target="_blank">ae-72-52.ebr2.Atlanta2.Level3.net</a> (<a href="http://4.68.103.61" target="_blank">4.68.103.61</a>) 20.014 ms <a href="http://ae-73-52.ebr3.Atlanta2.Level3.net" target="_blank">ae-73-52.ebr3.Atlanta2.Level3.net</a> (<a href="http://4.68.103.62" target="_blank">4.68.103.62</a>) 12.676 ms <a href="http://ae-72-52.ebr2.Atlanta2.Level3.net" target="_blank">ae-72-52.ebr2.Atlanta2.Level3.net</a> (<a href="http://4.68.103.61" target="_blank">4.68.103.61</a>) 15.941 ms<br>
> 7 <a href="http://ae-72-70.ebr2.Atlanta2.Level3.net" target="_blank">ae-72-70.ebr2.Atlanta2.Level3.net</a> (<a href="http://4.69.138.19" target="_blank">4.69.138.19</a>) 16.202 ms 22.283 ms <a href="http://ae-3.ebr2.Chicago1.Level3.net" target="_blank">ae-3.ebr2.Chicago1.Level3.net</a> (<a href="http://4.69.132.73" target="_blank">4.69.132.73</a>) 38.718 ms<br>
> 8 <a href="http://ae-3.ebr2.Chicago1.Level3.net" target="_blank">ae-3.ebr2.Chicago1.Level3.net</a> (<a href="http://4.69.132.73" target="_blank">4.69.132.73</a>) 38.730 ms <a href="http://ae-21-56.car1.Chicago1.Level3.net" target="_blank">ae-21-56.car1.Chicago1.Level3.net</a> (<a href="http://4.68.101.162" target="_blank">4.68.101.162</a>) 29.987 ms 29.489 ms<br>
> 9 <a href="http://ae-21-56.car1.Chicago1.Level3.net" target="_blank">ae-21-56.car1.Chicago1.Level3.net</a> (<a href="http://4.68.101.162" target="_blank">4.68.101.162</a>) 29.883 ms 39.977 ms 39.858 ms<br>
> 10 <a href="http://BIG-PIPE-IN.car1.Chicago1.Level3.net" target="_blank">BIG-PIPE-IN.car1.Chicago1.Level3.net</a> (<a href="http://4.79.208.150" target="_blank">4.79.208.150</a>) 40.018 ms <a href="http://rc1nr-pos0-7-0-0.wp.shawcable.net" target="_blank">rc1nr-pos0-7-0-0.wp.shawcable.net</a> (<a href="http://66.163.76.173" target="_blank">66.163.76.173</a>) 119.556 ms <a href="http://BIG-PIPE-IN.car1.Chicago1.Level3.net" target="_blank">BIG-PIPE-IN.car1.Chicago1.Level3.net</a> (<a href="http://4.79.208.150" target="_blank">4.79.208.150</a>) 32.356 ms<br>
> 11 <a href="http://rc2nr-pos14-0.wp.shawcable.net" target="_blank">rc2nr-pos14-0.wp.shawcable.net</a> (<a href="http://66.163.76.173" target="_blank">66.163.76.173</a>) 119.644 ms <a href="http://rc1so-pos14-0-0.cg.shawcable.net" target="_blank">rc1so-pos14-0-0.cg.shawcable.net</a> (<a href="http://66.163.77.157" target="_blank">66.163.77.157</a>) 87.529 ms <a href="http://rc1nr-pos0-7-0-0.wp.shawcable.net" target="_blank">rc1nr-pos0-7-0-0.wp.shawcable.net</a> (<a href="http://66.163.76.173" target="_blank">66.163.76.173</a>) 81.661 ms<br>
> 12 <a href="http://rc1so-pos14-0-0.cg.shawcable.net" target="_blank">rc1so-pos14-0-0.cg.shawcable.net</a> (<a href="http://66.163.77.157" target="_blank">66.163.77.157</a>) 102.119 ms 86.584 ms 90.816 ms<br>
> 13 <a href="http://rd1so-ge2-0-0.cg.shawcable.net" target="_blank">rd1so-ge2-0-0.cg.shawcable.net</a> (<a href="http://66.163.71.78" target="_blank">66.163.71.78</a>) 90.886 ms 91.067 ms <a href="http://dx1ok-g1.cg.shawcable.net" target="_blank">dx1ok-g1.cg.shawcable.net</a> (<a href="http://64.59.140.249" target="_blank">64.59.140.249</a>) 92.241 ms<br>
> 14 <a href="http://dx1ok-g1.cg.shawcable.net" target="_blank">dx1ok-g1.cg.shawcable.net</a> (<a href="http://64.59.140.249" target="_blank">64.59.140.249</a>) 97.235 ms 92.374 ms *<br>
> 15 * * *<br>
> 16 * * *<br>
> 17 * * *<br>
> 18 * * *<br>
> 19 * * *<br>
> 20 * * *<br>
> 21 * * *<br>
> 22 * * *<br>
> 23 * * *<br>
> 24 * * *<br>
> 25 * * *<br>
> 26 * * *<br>
> 27 * * *<br>
> 28 * * *<br>
> 29 * * *<br>
> 30 * * *<br>
<br>
I do not have anything going on other than ntpd and I do remain logged<br>
into my iGoogle account as well as <a href="http://weather.com/gold" target="_blank">weather.com/gold</a> and I was logged<br>
into Fedora Forums. Nothing else. Why would I be receiving traffic from<br>
Shaw Cable in (if memory serves me ) Toronto Canada? It seems mostly UDP<br>
packets. Is there anything else that I can use to see what's really<br>
going on?<br>
_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
</blockquote></div><br><br clear="all"><br>-- <br>John Clinton<br><a href="mailto:john@mysnmp.org">john@mysnmp.org</a><br>Mobile: 404.200.7333<br>
</div>