Hi ,
Some kids(?) are regularly packeting a box i have behind a bridge / firewall . Firewall/bridge system is a p166 32 ram running slackware 8 . Kernel is 2.4.17 patched with bridge-nf-0.0.6-against-2.4.17.diff . I am also using bridge-utils-0.9.5 to setup the bridge . Behind the bridge is a hub with a single box connected . The whole network runs at 10 Mbps . No processes other than the absolutely necessary ones are running on the firewall . Symptom : During the attacks the firewall becomes very slow . I press num lock and the light goes on after 30 seconds or so , i type something and it shows up after some seconds etc . It is almost frozen . The box behind it of course looses connectivity . When the attack ceases , or i pull the cable connecting to the internet the system instantly returns to normal . The bridge needs some more minutes to start working again but it eventually works . I am not sure if it is netfilter code /bridge code / obsolete hardware issue . However , the same box in the past has served as an irc server with kernel 2.4.0 , and handled various violent attacks like those ones without showing the same symptoms . Attached are the ruleset where the host under attack is 1.2.3.4 , and a small tcpdump snapshot of the attack . The whole tcpdump file of the attack is over 100 Mbytes . I wanted to know what you guys think about the issue . Should I get an athlon xp or something for the firewall ? Kind regards , -- ============================================================================= Dimitris Zilaskos Department of Physics @ Aristotle Univercity of Thessaloniki , Greece =============================================================================
#!/bin/sh mynet=1.2.3.0/24 iptables -F iptables -t nat -F iptables -P FORWARD DROP iptables -N logndrophidden iptables -N logndrop iptables -N logndropudp iptables -N logndroptcp iptables -N lognaccept iptables -N logscans iptables -A logscans -m limit --limit 2 --limit-burst 10 -j LOG --log-prefix 'Possible scan ' iptables -A logscans -j ACCEPT iptables -A logndroptcp -m limit --limit 6 --limit-burst 10 -j LOG --log-prefix 'Invalid TCP ' iptables -A logndroptcp -j DROP iptables -A logndropudp -m limit --limit 2 --limit-burst 10 -j LOG --log-prefix 'Invalid UDP ' iptables -A logndropudp -j DROP iptables -A logndrophidden -m limit --limit 4 --limit-burst 5 -j LOG \ --log-prefix 'Crap packet ' iptables -A logndrophidden -j DROP iptables -A logndrop -m limit --limit 10 --limit-burst 20 -j LOG --log-prefix 'Invalid state ' iptables -A logndrop -j DROP iptables -A lognaccept -j LOG iptables -A lognaccept -j ACCEPT iptables -A FORWARD -s 192.168.0.0/255.255.0.0 -d 0.0.0.0/0.0.0.0 -j DROP iptables -A FORWARD -s 10.0.0.0/255.0.0.0 -d 0.0.0.0/0.0.0.0 -j DROP iptables -A FORWARD -s 172.16.0.0/255.240.0.0 -d 0.0.0.0/0.0.0.0 -j DROP iptables -A FORWARD -s 127.0.0.0/255.255.0.0 -d 0.0.0.0/0.0.0.0 -j DROP iptables -A FORWARD -p tcp -s 0/0 -d 0/0 -m state --state INVALID \ -j logndroptcp iptables -A FORWARD -s 0/0 -d 0/0 -m state --state INVALID -j logndrop iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #hidden iptables -A FORWARD -s 1.2.3.4/32 -m state --state NEW -j ACCEPT iptables -A FORWARD -d 1.2.3.4/32 -p tcp -m multiport --dport 22,113 \ -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost1/32 -d 1.2.3.4/32 \ --dport 12345:12395 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost2/32 -d 1.2.3.4/32 \ --dport 12345:12395 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost3/32 -d 1.2.3.4/32 \ --dport 12345:12395 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost4/32 -d 1.2.3.4/32 \ --dport 12345:12395 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost5/32 -d 1.2.3.4/32 \ --dport 12345:12395 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost6/32 -d 1.2.3.4/32 \ --dport 12345:12395 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost7/32 -d 1.2.3.4/32 \ --dport 12345:12395 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost8/32 -d 1.2.3.4/32 \ --dport 12345:12395 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost1/32 -d 1.2.3.4/32 \ --dport 10000:10100 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost2/32 -d 1.2.3.4/32 \ --dport 10000:10100 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost3/32 -d 1.2.3.4/32 \ --dport 10000:10100 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost4/32 -d 1.2.3.4/32 \ --dport 10000:10100 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost5/32 -d 1.2.3.4/32 \ --dport 10000:10100 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost6/32 -d 1.2.3.4/32 \ --dport 10000:10100 -j ACCEPT iptables -A FORWARD -p tcp -s trustedhost7/32 -d 1.2.3.4/32 \ --dport 10000:10100 -j ACCEPT iptables -A FORWARD -p tcp -s 101.101.0.0/16 -d 1.2.3.4 --dport 54321 -j ACCEPT iptables -A FORWARD -p tcp -s 102.102.102.0/24 -d 1.2.3.4 --dport \ 54321 -j ACCEPT iptables -A FORWARD -p tcp -s 103.103.0.0/16 -d 1.2.3.4/32 --dport \ 55321 -j ACCEPT iptables -A FORWARD -s 0/0 -d 1.2.3.4/32 -j logndrophidden iptables -A FORWARD -p tcp -s nearbyhost/32 -d 1.2.3.4/32 -m multiport --dport 7770,8880,9990 -j ACCEPT
21:06:39.600659 12.162.155.165.14251 > 1.2.3.4.12160: S 839621617:839621617(0) win 65535 [tos 0x20] 21:06:39.600727 112.143.2.112.3746 > 1.2.3.4.12162: S 1709466047:1709466047(0) win 65535 [tos 0x20] 21:06:39.600791 115.248.12.58.20927 > 1.2.3.4.12163: S 1346535598:1346535598(0) win 65535 [tos 0x20] 21:06:39.600860 65.19.103.177.26217 > 1.2.3.4.12166: S 807310114:807310114(0) win 65535 [tos 0x20] 21:06:39.600926 81.78.104.116.59676 > 1.2.3.4.11935: S 651954788:651954788(0) win 65535 [tos 0x20] 21:06:39.600997 17.19.155.87.63886 > 1.2.3.4.11936: S 570474115:570474115(0) win 65535 [tos 0x20] 21:06:39.601062 60.49.16.209.4142 > 1.2.3.4.11938: S 1391989695:1391989695(0) win 65535 [tos 0x20] 21:06:39.601129 132.39.196.93.57252 > 1.2.3.4.11941: S 1214684087:1214684087(0) win 65535 [tos 0x20] 21:06:39.601197 99.230.146.43.32953 > 1.2.3.4.11948: S 47432907:47432907(0) win 65535 [tos 0x20] 21:06:39.601263 110.223.85.101.12831 > 1.2.3.4.11949: S 5790689:5790689(0) win 65535 [tos 0x20] 21:06:39.601329 132.174.186.179.2891 > 1.2.3.4.11950: S 2100388763:2100388763(0) win 65535 [tos 0x20] 21:06:39.601398 19.119.68.84.46735 > 1.2.3.4.11960: S 1294181137:1294181137(0) win 65535 [tos 0x20] 21:06:39.601465 8.110.109.190.27739 > 1.2.3.4.28221: S 893326686:893326686(0) win 65535 [tos 0x20] 21:06:39.601531 125.6.245.241.30817 > 1.2.3.4.11966: S 1830042140:1830042140(0) win 65535 [tos 0x20] 21:06:39.601599 39.121.78.179.39682 > 1.2.3.4.11968: S 2008399442:2008399442(0) win 65535 [tos 0x20] 21:06:39.601665 57.251.69.145.14153 > 1.2.3.4.11969: S 144870438:144870438(0) win 65535 [tos 0x20] 21:06:39.601734 81.60.154.236.29797 > 1.2.3.4.28233: S 490357894:490357894(0) win 65535 [tos 0x20] 21:06:39.601800 115.10.30.155.12652 > 1.2.3.4.11972: S 766950478:766950478(0) win 65535 [tos 0x20] 21:06:39.601868 162.145.160.11.46655 > 1.2.3.4.28232: S 1562684861:1562684861(0) win 65535 [tos 0x20] 21:06:39.601937 202.80.40.87.43408 > 1.2.3.4.28234: S 1524724527:1524724527(0) win 65535 [tos 0x20] 21:06:39.602000 58.204.48.173.50766 > 1.2.3.4.11976: S 1429785672:1429785672(0) win 65535 [tos 0x20] 21:06:39.602070 90.186.151.251.824 > 1.2.3.4.11977: S 1754948566:1754948566(0) win 65535 [tos 0x20] 21:06:39.602136 44.30.216.207.38398 > 1.2.3.4.28235: S 1805721337:1805721337(0) win 65535 [tos 0x20] 21:06:39.602204 144.19.230.202.15638 > 1.2.3.4.11980: S 1747189623:1747189623(0) win 65535 [tos 0x20] 21:06:39.602271 182.101.192.17.21591 > 1.2.3.4.11981: S 1510211596:1510211596(0) win 65535 [tos 0x20] 21:06:39.602336 72.143.226.219.28708 > 1.2.3.4.11982: S 599485532:599485532(0) win 65535 [tos 0x20] 21:06:39.602405 205.84.201.93.1711 > 1.2.3.4.11984: S 1682148135:1682148135(0) win 65535 [tos 0x20] 21:06:39.602473 74.182.26.146.1533 > 1.2.3.4.11986: S 1444521326:1444521326(0) win 65535 [tos 0x20] 21:06:39.602538 200.181.238.153.10756 > 1.2.3.4.28242: S 1129162292:1129162292(0) win 65535 [tos 0x20] 21:06:39.602605 199.99.128.169.6834 > 1.2.3.4.11995: S 1723251326:1723251326(0) win 65535 [tos 0x20] 21:06:39.602675 62.175.65.85.23656 > 1.2.3.4.11996: S 114806530:114806530(0) win 65535 [tos 0x20] 21:06:39.602740 53.183.217.7.4588 > 1.2.3.4.28254: S 748877166:748877166(0) win 65535 [tos 0x20] 21:06:39.602808 124.94.227.4.9800 > 1.2.3.4.28262: S 1515187137:1515187137(0) win 65535 [tos 0x20] 21:06:39.602874 15.248.207.214.49999 > 1.2.3.4.11999: S 1711667072:1711667072(0) win 65535 [tos 0x20] 21:06:39.602942 156.2.254.218.64575 > 1.2.3.4.12000: S 792946479:792946479(0) win 65535 [tos 0x20] 21:06:39.603010 179.42.18.151.53960 > 1.2.3.4.12002: S 2101543966:2101543966(0) win 65535 [tos 0x20] 21:06:39.603076 164.237.183.37.57362 > 1.2.3.4.28268: S 1760611683:1760611683(0) win 65535 [tos 0x20] 21:06:39.603144 174.172.212.97.42726 > 1.2.3.4.12006: S 1198366968:1198366968(0) win 65535 [tos 0x20] 21:06:39.603212 33.72.164.177.33465 > 1.2.3.4.12008: S 859006174:859006174(0) win 65535 [tos 0x20] 21:06:39.603278 175.36.103.37.41590 > 1.2.3.4.28275: S 136074000:136074000(0) win 65535 [tos 0x20] 21:06:39.603345 23.131.210.198.34983 > 1.2.3.4.12010: S 121432871:121432871(0) win 65535 [tos 0x20] 21:06:39.603410 6.141.32.168.12599 > 1.2.3.4.12011: S 240021497:240021497(0) win 65535 [tos 0x20] 21:06:39.603480 40.127.8.73.26541 > 1.2.3.4.12012: S 1446819579:1446819579(0) win 65535 [tos 0x20] 21:06:39.603546 146.213.187.220.16080 > 1.2.3.4.28278: S 1321426158:1321426158(0) win 65535 [tos 0x20] 21:06:39.603614 94.18.77.127.53892 > 1.2.3.4.28280: S 662198981:662198981(0) win 65535 [tos 0x20] 21:06:39.603682 141.12.86.147.23414 > 1.2.3.4.12015: S 1941359931:1941359931(0) win 65535 [tos 0x20] 21:06:39.603747 243.234.67.82.23068 > 1.2.3.4.12017: S 1971121561:1971121561(0) win 65535 [tos 0x20] 21:06:39.603816 131.218.204.213.31071 > 1.2.3.4.12018: S 1474838334:1474838334(0) win 65535 [tos 0x20] 21:06:39.603880 32.216.45.126.6778 > 1.2.3.4.28284: S 269043197:269043197(0) win 65535 [tos 0x20] 21:06:39.603950 111.97.7.216.572 > 1.2.3.4.28283: S 316798192:316798192(0) win 65535 [tos 0x20] 21:06:39.604016 50.254.194.164.48023 > 1.2.3.4.28285: S 459616805:459616805(0) win 65535 [tos 0x20] 21:06:39.604084 181.224.88.33.46533 > 1.2.3.4.12024: S 485646691:485646691(0) win 65535 [tos 0x20] 21:06:39.604152 1.103.164.21.6957 > 1.2.3.4.12025: S 1222562845:1222562845(0) win 65535 [tos 0x20] 21:06:39.604219 14.250.118.39.22121 > 1.2.3.4.12026: S 884751555:884751555(0) win 65535 [tos 0x20] 21:06:39.604284 143.5.64.254.21064 > 1.2.3.4.28287: S 983473622:983473622(0) win 65535 [tos 0x20] 21:06:39.604351 168.41.53.32.34020 > 1.2.3.4.12027: S 781001385:781001385(0) win 65535 [tos 0x20] 21:06:39.604421 20.132.198.52.61683 > 1.2.3.4.28288: S 794304947:794304947(0) win 65535 [tos 0x20] 21:06:39.604486 44.1.208.225.38184 > 1.2.3.4.12028: S 1614903298:1614903298(0) win 65535 [tos 0x20] 21:06:39.604556 251.238.101.252.54281 > 1.2.3.4.12029: S 200445458:200445458(0) win 65535 [tos 0x20] 21:06:39.604622 142.127.144.137.6133 > 1.2.3.4.12033: S 1006422406:1006422406(0) win 65535 [tos 0x20] 21:06:39.604687 194.255.152.92.47559 > 1.2.3.4.12034: S 1397179141:1397179141(0) win 65535 [tos 0x20] 21:06:39.604757 93.10.67.156.56290 > 1.2.3.4.28290: S 332365446:332365446(0) win 65535 [tos 0x20] 21:06:39.604821 103.108.212.125.60263 > 1.2.3.4.12035: S 1964568122:1964568122(0) win 65535 [tos 0x20] 21:06:39.604892 137.245.109.24.1789 > 1.2.3.4.12037: S 1130413985:1130413985(0) win 65535 [tos 0x20] 21:06:39.604957 13.63.114.37.47664 > 1.2.3.4.28297: S 1534269316:1534269316(0) win 65535 [tos 0x20] 21:06:39.605023 252.159.92.254.50259 > 1.2.3.4.28298: S 286484316:286484316(0) win 65535 [tos 0x20] 21:06:39.605091 110.64.70.34.31070 > 1.2.3.4.12040: S 293288789:293288789(0) win 65535 [tos 0x20] 21:06:39.605156 102.159.143.71.26038 > 1.2.3.4.12042: S 766535402:766535402(0) win 65535 [tos 0x20] 21:06:39.605227 76.253.53.213.1442 > 1.2.3.4.12041: S 829234413:829234413(0) win 65535 [tos 0x20] 21:06:39.605293 27.8.64.234.1244 > 1.2.3.4.28300: S 738738299:738738299(0) win 65535 [tos 0x20] 21:06:39.605361 217.172.134.63.49941 > 1.2.3.4.12046: S 2109344134:2109344134(0) win 65535 [tos 0x20] 21:06:39.605428 165.222.228.18.58939 > 1.2.3.4.28303: S 1779177185:1779177185(0) win 65535 [tos 0x20] 21:06:39.605492 19.20.28.46.20828 > 1.2.3.4.28304: S 1182576153:1182576153(0) win 65535 [tos 0x20] 21:06:39.605561 69.205.233.210.44312 > 1.2.3.4.28306: S 1400709980:1400709980(0) win 65535 [tos 0x20] 21:06:39.605627 120.163.227.29.16327 > 1.2.3.4.28307: S 1822216495:1822216495(0) win 65535 [tos 0x20] 21:06:39.605694 255.250.183.227.11838 > 1.2.3.4.12055: S 1539784612:1539784612(0) win 65535 [tos 0x20] 21:06:39.605763 52.136.70.117.55002 > 1.2.3.4.28309: S 1117644591:1117644591(0) win 65535 [tos 0x20] 21:06:39.605829 114.111.84.234.10552 > 1.2.3.4.28311: S 1545573383:1545573383(0) win 65535 [tos 0x20] 21:06:39.605898 75.30.202.101.41076 > 1.2.3.4.28317: S 1755732915:1755732915(0) win 65535 [tos 0x20] 21:06:39.605964 46.147.128.112.27555 > 1.2.3.4.12063: S 2050095538:2050095538(0) win 65535 [tos 0x20] 21:06:39.607181 0.150.162.135.20857 > 1.2.3.4.12068: S 1990706310:1990706310(0) win 65535 [tos 0x20] 21:06:39.607250 243.44.11.141.63977 > 1.2.3.4.28328: S 1818584017:1818584017(0) win 65535 [tos 0x20] 21:06:39.607317 165.159.145.81.5728 > 1.2.3.4.12073: S 678110946:678110946(0) win 65535 [tos 0x20] 21:06:39.607385 39.1.225.59.48808 > 1.2.3.4.28335: S 800020166:800020166(0) win 65535 [tos 0x20] 21:06:39.607453 150.213.123.185.58644 > 1.2.3.4.28340: S 43973131:43973131(0) win 65535 [tos 0x20] 21:06:39.607519 63.231.79.160.13776 > 1.2.3.4.28345: S 1482748117:1482748117(0) win 65535 [tos 0x20] 21:06:39.607585 53.120.226.12.5507 > 1.2.3.4.28347: S 1823768117:1823768117(0) win 65535 [tos 0x20] 21:06:39.607655 55.45.130.250.29256 > 1.2.3.4.12101: S 240030249:240030249(0) win 65535 [tos 0x20] 21:06:39.607718 241.223.140.40.58382 > 1.2.3.4.12105: S 641454627:641454627(0) win 65535 [tos 0x20] 21:06:39.607790 30.201.149.184.22173 > 1.2.3.4.12108: S 1964129709:1964129709(0) win 65535 [tos 0x20] 21:06:39.607856 97.247.102.73.10855 > 1.2.3.4.28376: S 322796954:322796954(0) win 65535 [tos 0x20] 21:06:39.607924 43.43.151.242.44014 > 1.2.3.4.12119: S 181479747:181479747(0) win 65535 [tos 0x20] 21:06:39.607990 217.51.138.200.14340 > 1.2.3.4.28378: S 1879426650:1879426650(0) win 65535 [tos 0x20] 21:06:39.608058 41.36.83.16.194 > 1.2.3.4.28377: S 1139206480:1139206480(0) win 65535 [tos 0x20] 21:06:39.608121 17.246.209.53.47285 > 1.2.3.4.12121: S 1423761344:1423761344(0) win 65535 [tos 0x20] 21:06:39.608191 84.131.243.139.31315 > 1.2.3.4.12120: S 858534059:858534059(0) win 65535 [tos 0x20] 21:06:39.608256 154.181.209.143.2971 > 1.2.3.4.28379: S 1755266159:1755266159(0) win 65535 [tos 0x20] 21:06:39.608324 242.121.233.203.14195 > 1.2.3.4.28382: S 1122710419:1122710419(0) win 65535 [tos 0x20] 21:06:39.608392 135.91.21.167.8445 > 1.2.3.4.28384: S 1100049448:1100049448(0) win 65535 [tos 0x20] 21:06:39.608458 52.214.43.177.9497 > 1.2.3.4.28387: S 744169928:744169928(0) win 65535 [tos 0x20] 21:06:39.608529 153.93.16.76.20311 > 1.2.3.4.12156: S 2015717972:2015717972(0) win 65535 [tos 0x20] 21:06:39.608593 69.55.17.175.22701 > 1.2.3.4.28416: S 732603909:732603909(0) win 65535 [tos 0x20] 21:06:39.608661 131.2.70.31.46507 > 1.2.3.4.12161: S 1807595069:1807595069(0) win 65535 [tos 0x20] 21:06:39.608728 135.145.34.10.9320 > 1.2.3.4.12165: S 968218153:968218153(0) win 65535 [tos 0x20] 21:06:39.608794 150.11.225.9.46062 > 1.2.3.4.12167: S 1326068547:1326068547(0) win 65535 [tos 0x20] 21:06:39.608860 178.108.108.66.39848 > 1.2.3.4.28421: S 1050151023:1050151023(0) win 65535 [tos 0x20] 21:06:39.608931 84.237.218.129.26148 > 1.2.3.4.28427: S 652197715:652197715(0) win 65535 [tos 0x20] 21:06:39.608996 148.170.90.229.10413 > 1.2.3.4.28426: S 845324656:845324656(0) win 65535 [tos 0x20] 21:06:39.609065 40.245.90.188.55988 > 1.2.3.4.28430: S 1693859233:1693859233(0) win 65535 [tos 0x20] 21:06:39.609131 170.97.17.254.52204 > 1.2.3.4.28431: S 1156191615:1156191615(0) win 65535 [tos 0x20] 21:06:39.609198 154.186.160.106.17663 > 1.2.3.4.28433: S 178719792:178719792(0) win 65535 [tos 0x20] 21:06:39.609266 181.243.159.221.4601 > 1.2.3.4.28434: S 138817945:138817945(0) win 65535 [tos 0x20] 21:06:39.609333 250.213.157.131.47575 > 1.2.3.4.28439: S 1225278902:1225278902(0) win 65535 [tos 0x20] 21:06:39.609398 114.30.61.39.59356 > 1.2.3.4.28438: S 758323460:758323460(0) win 65535 [tos 0x20] 21:06:39.609465 34.117.243.28.21392 > 1.2.3.4.28443: S 1229238943:1229238943(0) win 65535 [tos 0x20] 21:06:39.609534 149.225.83.84.35501 > 1.2.3.4.28451: S 789244469:789244469(0) win 65535 [tos 0x20] 21:06:39.609603 29.194.251.237.39084 > 1.2.3.4.28453: S 881993124:881993124(0) win 65535 [tos 0x20] 21:06:39.609667 155.25.29.235.12880 > 1.2.3.4.28456: S 2134828151:2134828151(0) win 65535 [tos 0x20] 21:06:39.609734 185.225.168.47.58848 > 1.2.3.4.28464: S 256648512:256648512(0) win 65535 [tos 0x20] 21:06:39.609803 162.48.126.73.17412 > 1.2.3.4.28466: S 1078137283:1078137283(0) win 65535 [tos 0x20] 21:06:39.609869 247.100.203.183.25503 > 1.2.3.4.28219: S 50076895:50076895(0) win 65535 [tos 0x20] 21:06:39.609936 182.222.237.160.58364 > 1.2.3.4.28217: S 1433840865:1433840865(0) win 65535 [tos 0x20] 21:06:39.610003 16.84.113.226.19629 > 1.2.3.4.28469: S 31391820:31391820(0) win 65535 [tos 0x20] 21:06:39.610056 135.87.63.170.37733 > 1.2.3.4.28222: S 232979023:232979023(0) win 65535 [tos 0x20] 21:06:39.610121 73.63.94.43.3074 > 1.2.3.4.28224: S 541644014:541644014(0) win 65535 [tos 0x20] 21:06:39.610188 209.29.213.200.26016 > 1.2.3.4.28223: S 715306623:715306623(0) win 65535 [tos 0x20] 21:06:39.610255 255.143.32.8.60814 > 1.2.3.4.28225: S 204825542:204825542(0) win 65535 [tos 0x20] 21:06:39.610325 103.92.59.9.24505 > 1.2.3.4.28470: S 465412434:465412434(0) win 65535 [tos 0x20] 21:06:39.610392 104.64.158.178.54781 > 1.2.3.4.28228: S 1514764509:1514764509(0) win 65535 [tos 0x20] 21:06:39.610457 154.255.203.154.25323 > 1.2.3.4.28229: S 945193122:945193122(0) win 65535 [tos 0x20] 21:06:39.610524 134.201.203.87.9376 > 1.2.3.4.28227: S 101534751:101534751(0) win 65535 [tos 0x20] 21:06:39.610593 203.239.122.110.14874 > 1.2.3.4.28236: S 1999691641:1999691641(0) win 65535 [tos 0x20] 21:06:39.610659 209.53.22.155.12606 > 1.2.3.4.28238: S 1288823539:1288823539(0) win 65535 [tos 0x20] 21:06:39.610727 252.248.68.200.50622 > 1.2.3.4.28240: S 688981558:688981558(0) win 65535 [tos 0x20] 21:06:39.610793 111.66.39.191.57161 > 1.2.3.4.28243: S 1239445307:1239445307(0) win 65535 [tos 0x20] 21:06:39.610860 149.140.165.93.35475 > 1.2.3.4.28246: S 356141302:356141302(0) win 65535 [tos 0x20] 21:06:39.610929 43.152.42.154.30802 > 1.2.3.4.28247: S 1243462745:1243462745(0) win 65535 [tos 0x20] 21:06:39.610996 210.68.18.103.48823 > 1.2.3.4.28250: S 1711941828:1711941828(0) win 65535 [tos 0x20] 21:06:39.611062 217.227.202.138.54335 > 1.2.3.4.28257: S 122461016:122461016(0) win 65535 [tos 0x20] 21:06:39.611129 209.208.238.143.28190 > 1.2.3.4.28256: S 185366840:185366840(0) win 65535 [tos 0x20] 21:06:39.611196 189.80.202.142.6328 > 1.2.3.4.28260: S 1918523677:1918523677(0) win 65535 [tos 0x20] 21:06:39.611263 63.24.235.32.3510 > 1.2.3.4.28542: S 1755958015:1755958015(0) win 65535 [tos 0x20] 21:06:39.611332 128.23.153.223.32984 > 1.2.3.4.28544: S 93700109:93700109(0) win 65535 [tos 0x20] 21:06:39.611397 129.27.90.62.27172 > 1.2.3.4.28264: S 1672398796:1672398796(0) win 65535 [tos 0x20] 21:06:39.611465 140.221.234.179.62271 > 1.2.3.4.28265: S 338635700:338635700(0) win 65535 [tos 0x20] 21:06:39.611534 110.95.63.234.56866 > 1.2.3.4.28266: S 516241135:516241135(0) win 65535 [tos 0x20] 21:06:39.611598 255.47.248.254.48174 > 1.2.3.4.28543: S 204342705:204342705(0) win 65535 [tos 0x20] 21:06:39.611669 117.106.176.60.15670 > 1.2.3.4.28267: S 1842564623:1842564623(0) win 65535 [tos 0x20] 21:06:39.611734 199.89.104.53.60839 > 1.2.3.4.28270: S 1401305376:1401305376(0) win 65535 [tos 0x20] 21:06:39.611801 37.245.54.202.44526 > 1.2.3.4.28272: S 1717638127:1717638127(0) win 65535 [tos 0x20] 21:06:39.611868 74.157.21.17.16765 > 1.2.3.4.28274: S 1051720007:1051720007(0) win 65535 [tos 0x20] 21:06:39.611934 109.82.90.132.47115 > 1.2.3.4.28555: S 528408948:528408948(0) win 65535 [tos 0x20] 21:06:39.612004 32.53.55.70.10094 > 1.2.3.4.28276: S 1308016656:1308016656(0) win 65535 [tos 0x20] 21:06:39.612070 14.92.255.250.46418 > 1.2.3.4.28277: S 471806810:471806810(0) win 65535 [tos 0x20] 21:06:39.612137 115.7.82.169.63227 > 1.2.3.4.28557: S 793673473:793673473(0) win 65535 [tos 0x20] 21:06:39.612201 105.77.53.24.34972 > 1.2.3.4.28279: S 1988782397:1988782397(0) win 65535 [tos 0x20] 21:06:39.617133 114.242.213.128.61140 > 1.2.3.4.28281: S 1081167994:1081167994(0) win 65535 [tos 0x20] 21:06:39.617140 170.39.213.61.46992 > 1.2.3.4.28282: S 1576292121:1576292121(0) win 65535 [tos 0x20] 21:06:39.617147 242.21.64.71.55153 > 1.2.3.4.28563: S 1240767241:1240767241(0) win 65535 [tos 0x20] 21:06:39.617155 63.108.159.234.1652 > 1.2.3.4.28286: S 127293223:127293223(0) win 65535 [tos 0x20] 21:06:39.617164 45.252.79.25.22794 > 1.2.3.4.28564: S 2008520724:2008520724(0) win 65535 [tos 0x20] 21:06:39.617172 47.68.112.159.3595 > 1.2.3.4.28569: S 1438398194:1438398194(0) win 65535 [tos 0x20] 21:06:39.617179 32.249.154.216.28482 > 1.2.3.4.28570: S 1752195006:1752195006(0) win 65535 [tos 0x20] 21:06:39.617187 71.109.176.121.2163 > 1.2.3.4.28289: S 636626718:636626718(0) win 65535 [tos 0x20] 21:06:39.617195 198.7.193.246.49 > 1.2.3.4.28573: S 203792021:203792021(0) win 65535 [tos 0x20] 21:06:39.617202 23.40.190.95.23150 > 1.2.3.4.28293: S 1618100952:1618100952(0) win 65535 [tos 0x20] 21:06:39.617209 98.28.129.108.4399 > 1.2.3.4.28295: S 334835205:334835205(0) win 65535 [tos 0x20] 21:06:39.617216 207.29.156.145.4362 > 1.2.3.4.28296: S 1807152743:1807152743(0) win 65535 [tos 0x20] 21:06:39.617222 193.100.74.128.9139 > 1.2.3.4.28575: S 1063404007:1063404007(0) win 65535 [tos 0x20] 21:06:39.617230 1.225.246.94.49977 > 1.2.3.4.28294: S 141868283:141868283(0) win 65535 [tos 0x20] 21:06:39.617237 108.140.87.207.24537 > 1.2.3.4.28299: S 1225885243:1225885243(0) win 65535 [tos 0x20] 21:06:39.617244 88.27.121.22.60246 > 1.2.3.4.28581: S 1331912602:1331912602(0) win 65535 [tos 0x20] 21:06:39.617251 109.185.106.176.49490 > 1.2.3.4.28580: S 335300355:335300355(0) win 65535 [tos 0x20] 21:06:39.617257 65.185.188.3.36102 > 1.2.3.4.28579: S 1066508163:1066508163(0) win 65535 [tos 0x20] 21:06:39.617263 207.186.231.17.2979 > 1.2.3.4.28583: S 1758814740:1758814740(0) win 65535 [tos 0x20] 21:06:39.617270 80.244.20.58.42787 > 1.2.3.4.28582: S 310816183:310816183(0) win 65535 [tos 0x20] 21:06:39.617276 33.129.47.113.22083 > 1.2.3.4.28586: S 907396267:907396267(0) win 65535 [tos 0x20] 21:06:39.617283 57.103.98.8.64074 > 1.2.3.4.28587: S 1796563481:1796563481(0) win 65535 [tos 0x20] 21:06:39.617290 149.237.45.38.50629 > 1.2.3.4.28588: S 553371940:553371940(0) win 65535 [tos 0x20] 21:06:39.617296 249.199.211.32.16261 > 1.2.3.4.28589: S 1414473120:1414473120(0) win 65535 [tos 0x20] 21:06:39.617302 65.56.148.185.9591 > 1.2.3.4.28305: S 156100159:156100159(0) win 65535 [tos 0x20] 21:06:39.617309 147.255.55.127.19783 > 1.2.3.4.28312: S 1139516285:1139516285(0) win 65535 [tos 0x20] 21:06:39.617315 26.116.170.78.50672 > 1.2.3.4.28313: S 1103623875:1103623875(0) win 65535 [tos 0x20] 21:06:39.617322 250.245.16.243.58852 > 1.2.3.4.28593: S 265918996:265918996(0) win 65535 [tos 0x20] 21:06:39.617328 215.105.180.98.42985 > 1.2.3.4.28594: S 614452750:614452750(0) win 65535 [tos 0x20] 21:06:39.617335 77.78.43.245.34036 > 1.2.3.4.28595: S 1246896854:1246896854(0) win 65535 [tos 0x20] 21:06:39.617341 189.203.242.158.43872 > 1.2.3.4.28314: S 808316356:808316356(0) win 65535 [tos 0x20] 21:06:39.617347 248.243.233.242.57082 > 1.2.3.4.28597: S 843650534:843650534(0) win 65535 [tos 0x20] 21:06:39.617470 165.222.250.124.28590 > 1.2.3.4.28598: S 809061854:809061854(0) win 65535 [tos 0x20] 21:06:39.617479 98.151.236.175.25368 > 1.2.3.4.28599: S 1380169636:1380169636(0) win 65535 [tos 0x20] 21:06:39.617487 194.252.24.186.514 > 1.2.3.4.28601: S 1398565805:1398565805(0) win 65535 [tos 0x20] 21:06:39.617495 215.252.147.124.12685 > 1.2.3.4.28602: S 1657420793:1657420793(0) win 65535 [tos 0x20] 21:06:39.617503 119.138.11.71.47556 > 1.2.3.4.28327: S 613764965:613764965(0) win 65535 [tos 0x20] 21:06:39.617510 16.162.243.211.39207 > 1.2.3.4.28330: S 398490251:398490251(0) win 65535 [tos 0x20] 21:06:39.617518 48.150.55.35.20291 > 1.2.3.4.28332: S 176119216:176119216(0) win 65535 [tos 0x20] 21:06:39.617525 114.71.230.130.11225 > 1.2.3.4.28334: S 1845303126:1845303126(0) win 65535 [tos 0x20] 21:06:39.617532 192.44.129.12.30585 > 1.2.3.4.28333: S 1135477609:1135477609(0) win 65535 [tos 0x20] 21:06:39.617540 178.43.150.89.53942 > 1.2.3.4.28616: S 1401714029:1401714029(0) win 65535 [tos 0x20] 21:06:39.617547 123.51.165.139.40599 > 1.2.3.4.28617: S 1062588861:1062588861(0) win 65535 [tos 0x20]
