Yes, I'm being UDP flooded. I worked that out by grepping /etc/protocols.
On 12/09/2017 18:24, Matt Harris wrote:
Protocol 17 is UDP. UDP is pretty common on the internet. Not sure
why source and destination ports aren't being shown by your tool
there, might be malformed UDP packets designed to obscure themselves
from or otherwise evade some intrusion detection or firewall systems.
On Tue, Sep 12, 2017 at 8:08 PM, Large Hadron Collider
<large.hadron.colli...@gmx.com <mailto:large.hadron.colli...@gmx.com>>
wrote:
18:04:32.391082 IP 138-122-97-251.internet.static.ientc.mx
<http://138-122-97-251.internet.static.ientc.mx> > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391088 IP 138-122-97-251.internet.static.ientc.mx
<http://138-122-97-251.internet.static.ientc.mx> > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391110 IP 115.75.50.106.35180 > umbrellix.net.10454: UDP,
bad length 65500 > 1464
18:04:32.391145 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391152 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391158 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391164 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391170 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391176 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391182 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391188 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391194 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391199 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391205 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391211 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391217 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391223 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391229 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391234 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391248 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391255 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391261 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391266 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391272 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391278 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391284 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391289 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391295 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391313 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391319 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391325 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391331 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391336 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391342 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391348 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391354 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391367 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391374 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391379 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391385 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391391 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391396 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391402 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391408 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391414 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391420 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
18:04:32.391426 IP 115.75.50.106 > umbrellix.net
<http://umbrellix.net>: ip-proto-17
Some stupidity has me wondering... protocol 17? Huh?
Is this some attempt to exploit me while at the same time flooding
me at over 800Mbit/s?
Needless to say, I've shut my computer down to avoid going over my
data allowance.
--
Matt Harris - Chief Security Officer
Main: +1 855.696.3834 ext 103
Mobile: +1 908.590.9472
Email:m...@netfire.net <mailto:m...@netfire.net>
