Re: Increase of DOS attacks using TCP src and/or dst of 0

7 Mar 2012


      On Wed, Mar 7, 2012 at 1:45 PM, Matthew Huff <mhuff@ox.com> wrote:
...
Anyone else see a massive increase of scanning/dos with TCP source and/or
dst port of 0? We started seeing a massive increase today creating some
issue with our firewalls.
Not seeing a ton of them, but do see a few logged on most all of our
server like:

Mar  5 07:49:13 server kernel: Shorewall:logflags:DROP:IN=eth2 OUT=
MAC=00:07:e9:0f:39:f1:00:03:31:a5:74:00:08:00 SRC=178.18.16.101
DST=x.x.x.x LEN=56 TOS=0x00 PREC=0x00 TTL=204 ID=49665 DF PROTO=TCP
SPT=0 DPT=0 WINDOW=37009 RES=0x14 URG ACK RST SYN FIN URGP=37422


-- 
Chris Stone
AxisInternet, Inc.
www.axint.net