On Fri, 28 Oct 2005 21:18:27 +0200, "Allan Kjeldbjerg (Acom Internet ApS)" said: > Hi _mutiger_jh, > > Yes I have notice the increase of the same packets. They could be spoofed > but the one I currently > notice originate from China and is distributed via ISP's in New York. > > Concurrently with these packets we expirence non terminating TCP connections > on our Windows platform. > - Could there be a connection between the two? Anyone noticed the same > pattern?
Out of curiosity, are these fragged packets? I'm wondering if the first frag is getting lost and something's misinterpreting a 2nd or following frag - remember that the *real* TCP/UPD/ICMP header is only in the first frag. So if your monitoring tool looks at a subsequent frag, it could be minsinterpreting the payload as header (similar to the tool that misinterpreted an ICMP as UDP and got a port number instead of a ICMP type/code).
pgpFQ6GI970Vr.pgp
Description: PGP signature
