lkml.org 
[lkml]   [1999]   [Mar]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 2.0.36: ip_masqurade and stealth scan DoS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

hi

I have meet the seem problem.I wrote a little perl script to monit
the TCP_CONNECT count.When I found sb. use the scan program, I
disconnect he network connection about 10 mins.

I attech it to you.Hope this script can be useful to you.


BTW: I¡¡modified the include/net/ip_masq.h ---> the prots number that
ip_msaq can use.(defalut is 4k): I have change it to:
#define PORT_MASQ_BEGIN 41000
#define PORT_MASQ_END (PORT_MASQ_BEGIN+16384)

And I changed the net/ipv4/ip_masq.c too.There was a
#define IP_MASQ_TAB_SIZE 8192 ( I change it to 8192).

yours saka

_ _
// Yu Guanghui /> Network Center \
// ygh@rose.dlut.edu.cn // Dalian Univ. of Tech. //
\> http://banyan.dlut.edu.cn/~ygh </ China </

On Mon, 8 Mar 1999, Daniel Ryde wrote:

> Hi,
>
> We have a problem with ip_masqurading set up as a firewall. When someone
> runs a stealth scan from the masquraded net to the outside net, it will
> very fast consume all available masqurade ports. The result is a nasty
> DoS for all adresses on the masquraded net.
>
> Is there any possibly limit on masqurade ports per source adress?
> This would effectively stop the scan, and limit the DoS to the offender
> only.
>
> I guess this problem also affects 2.2 kernels as well.
>
> Is there anyone else that has been hit by this problem?
>
>
> Best Regards
>
> Daniel Ryde, System Administrator
> __________________________________________________________________________
> Tripnet AB Visit Address: Telephone: +46 31 7252500
> Box 5071 Avagen 42 Facsimile: +46 31 7252501
> S-402 22 GOTEBORG GOTEBORG Email: ryde@tripnet.se
> Sweden Sweden
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.rutgers.edu
> Please read the FAQ at http://www.tux.org/lkml/
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v0.9.1 (GNU/Linux)
Comment: Made with PGP4Pine

iD8DBQE25N8EfO4+kLYAZ4MRAny9AJ9wkDi0Wui/1m4JgCiqKjQokvzzrQCfeQX9
QLRsqhcNrlMB3I0u1GGJIMs=
=nhC8
-----END PGP SIGNATURE-----
#!/usr/bin/perl

open(LOG, ">/var/log/proxyht.log");
select(LOG);
while(1){


@IpList=();

open(masq,"/proc/net/ip_masquerade")|| die "Cant open /proc/net/ip_masquerade:$!\n";

while(<masq>){
($Prc,$From,$To,$Masq,$Initseq,$Delta,$PDelta,$Expires)=split(/ /);
if( $Prc=~/TCP/){
($FromIP,$FPrt)=split(/:/,$From);
}

if($IPtab{$FromIP} eq ""){
$IPtab{$FromIP}=1;
}else{
$IPtab{$FromIP}++;
}
}


while (($IP, $count) = each(%IPtab)) {
if($count >100 ){
$ascip=addr_inet(hex($IP));

$now_time=localtime;
$IpListCnt{$ascip} = 0 unless defined ( $IpListCnt{$ascip});
}
}

while (($IP,$count) = each (%IpListCnt))
{
$IpListCnt{$IP}++;
if ( $IpListCnt{$IP} == 1 )
{
`/sbin/ipfwadm -I -i deny -S $IP/32 -D 0.0.0.0/0`;
printf("$now_time $IP is using Proxy Hunter!!\n");;
}
else
{
if ( $IpListCnt{$IP} == 300)
{
`/sbin/ipfwadm -I -d deny -S $IP/32 -D 0.0.0.0/0`;
$now_time=localtime;
printf("$now_time Delete $IP \n");
delete ( $IpListCnt{$IP});

}
}
}

%IPtab={};
close(masq);
sleep 2;

} #while


close(LOG);
exit(0);

sub addr_inet()
{
my($digip) = @_;
my($h1) = $digip/(2 ** 24);
my($h2) = ($digip % 2 ** 24)/(2 ** 16);
my($h3) = ($digip % 2 ** 16) /(2 ** 8);
my($h4) = $digip % 256;

sprintf("%d.%d.%d.%d", $h1, $h2, $h3, $h4);

}


\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.026 / U:0.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site