| |
ZL3AI > APRDIG 07.09.03 10:10l 149 Lines 4684 Bytes #999 (0) @ WW
BID : 1873-ZL3AI
Read: GUEST
Subj: TAPR Digest, Sep 04, 3/3
Path: DB0FHN<DB0RGB<OK0PPL<DB0RES<ON0AR<ZL2BAU<ZL3VML
Sent: 030906/1350Z @:ZL3VML.#80.NZL.OC #:7870 [Chch-NZ] FBB7.00i $:1873-ZL3AI
From: ZL3AI@ZL3VML.#80.NZL.OC
To : APRDIG@WW
Subject: RE: aprsfl.net appearing as "port-scanner"
From: "Dave Anderson" <dandersn@citicom.com>
Date: Thu, 4 Sep 2003 22:12:22 -0400
X-Message-Number: 13
Neil,
That server sits behind a Cisco PIX firewall.
It only has the ability to send out packets as replies to ones from the host
opening the TCP connection to it as acknolegment packets.
The server itself has no outbound access configured with the exception of
the other 3 core APRS-IS servers on port 1313.
I can reassure you that box is not port scanning you, both by looking over
that machines IDS sensor, and the PIX's firewall logs. Nothing out of
normal APRS-IS traffic is leaving that IP address.
Those other ports, IP's, and scans could not be our network. Source
spoofing at our border router would preven it, and source/destination
matches on netbios and many of the others listed are not allowed either way
at -any- of the routers between that server and our connection to the net.
It may be your IDS catching the quantity of small TCP packets associated
with APRS-IS relating to us, but that would be it. As far as why their
system reports it, it is probably the same issue. Even my firewall at home
catchs APRS-IS packets as tcp fragmenting, due to the quantity and size of
the packets.
Perhaps Pete, the author of JavaAPRSrvr can chime in with some insite to the
packets.
Oh, yea, and BTW, that's not a super signifigant amount of hits. My PIX
with over 600 IP's behind it for webhosting logs some 500,000 - 700,000
"doorknob" giggles daily.
Seeya,
Dave
KG4YZY
www.aprsfl.net
----------------------------------------------------------------------
Subject: RE: aprsfl.net appearing as "port-scanner"
From: "Dave Anderson" <dandersn@citicom.com>
Date: Thu, 4 Sep 2003 22:44:48 -0400
X-Message-Number: 14
Neil,
As suspected, it's APRS traffic.
Look at : http://www.dshield.org/warning_explanation.php?fip=64.58.200.20
Date Source Source Port Target Port Protocol Flags Description
2003-08-12 064.058.200.020 10152 6016 6
2003-08-12 064.058.200.020 10152 6016 6
2003-08-12 064.058.200.020 10152 6016 6
2003-08-12 064.058.200.020 10152 6016 6
2003-08-12 064.058.200.020 10152 6044 6
2003-08-12 064.058.200.020 10152 6044 6
2003-08-12 064.058.200.020 10152 6044 6
2003-08-12 064.058.200.020 10152 6044 6
2003-08-12 064.058.200.020 10152 6075 6
2003-08-12 064.058.200.020 10152 6075 6
2003-08-12 064.058.200.020 10152 6075 6
2003-08-12 064.058.200.020 10152 6075 6
2003-08-12 064.058.200.020 10152 6075 6
2003-08-12 064.058.200.020 10152 6361 6
2003-08-12 064.058.200.020 10152 6361 6
2003-08-12 064.058.200.020 10152 6361 6
2003-08-12 064.058.200.020 10152 6361 6
2003-08-13 064.058.200.020 10152 6495 6
2003-08-13 064.058.200.020 10152 6495 6
2003-08-13 064.058.200.020 10152 6495 6
2003-08-13 064.058.200.020 10152 6495 6
2003-08-13 064.058.200.020 10152 6594 6
2003-08-13 064.058.200.020 10152 6594 6
2003-08-13 064.058.200.020 10152 6594 6
2003-08-13 064.058.200.020 10152 6594 6
These are all valid APRS packets being flagged by some routers as problem
packets, primarily due to their size.
It's not a port scan, it's not spoofed addresses.
Seeya,
Dave
KG4YZY
www.aprsfl.net
----------------------------------------------------------------------
Subject: Re: aprsfl.net appearing as "port-scanner"
From: Neil Johnson <njohnsn@njohnsn.com>
Date: Thu, 4 Sep 2003 22:28:40 -0500
X-Message-Number: 16
Okay, Okay.
I've jumped the gun a bit. My apologies.
Some background.
I'm running aprsd as an IGATE. I also use it as a local aprs server to view
APRS IS-IS traffic using xastir from another box (why have 2 duplicate feeds
of data coming in my DSL line ?).
All my machines are behind a NAT/router (DLink 614+).
I'm not allowing any incoming connections into the aprsd server from the
outside. I only have a 256Kb/s down, 128Kb/s up ADSL line and the aprsd
server is only a 133 MHz AMD K5 with 16MB of RAM (isn't Linux great !).
Here are the server lines from aprsd.conf file:
Server aprswest.net 10152 hub-sr
Server aprsca.net 10152 hub-sr
Server aprsfl.net 10152 hub-sr
What these logs are telling me that aprsfl attempts to connect to my aprsd
server on a regular basis.
Why ?
--
Neil Johnson
http://www.njohnsn.com
PGP key available on request.
----------------------------------------------------------------------
Subject: Re: Help with Time Stamp
From: "B. Hildebrand" <bhildebrand@earthlink.net>
Date: Thu, 4 Sep 2003 20:39:20 -0700
X-Message-Number: 17
APRS+SA shows UTC by default as read from the system clock. To display in
Local time, set UTC=0 in the Config section of Settings.
Brent KH2Z
---
END OF DIGEST
Read previous mail | Read next mail
| |
