strange packets from 192.168.1.126

strange packets from 192.168.1.126
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Networking Firewalls    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
strange packets from 192.168.1.126 Kevin VW 02-21-2008
Posted by Kevin VW on February 21, 2008, 12:54 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Dear all,

I've recently noticed some packets coming in on port 22 (sshd) on my
external interface from the 192.168.1.0/24 network. I don't have any
local machines on this network and the packets are coming in on my WAN
interface (via my router). How is that possible? My understanding was
that this network was not routeable from the internet. I'm guessing
someone is try to get at my sshd server. Below are the packets. Is
there any way to get more info on where they are coming from?

Feb 20 20:02:14 tti kernel: iptables chain hostile: IN=eth1 OUT=
MAC=00:0e:0c:dd:73:16:00:11:6e:00:f9:70:08:00 SRC=192.168.1.126
DST=172.16.251.61 LEN=228 TOS=0x10 PREC=0x00 TTL=47 ID=19109 DF
PROTO=TCP SPT=38196 DPT=22 WINDOW=16022 RES=0x00 ACK PSH FIN URGP=0

I'm using iptables on a 2.6 Linux box.

Kevin

Posted by Sebastian G. on February 21, 2008, 3:40 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Kevin VW wrote:

> Dear all,
>
> I've recently noticed some packets coming in on port 22 (sshd) on my
> external interface from the 192.168.1.0/24 network. I don't have any
> local machines on this network and the packets are coming in on my WAN
> interface (via my router). How is that possible? My understanding was
> that this network was not routeable from the internet.


It might still be routable within your ISP's backbone.

It might also have changed its IP address due to reassembly of overlapping
IP fragments.

Posted by BlinkyBee on February 21, 2008, 8:39 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Kevin VW wrote:
>
>> Dear all,
>>
>> I've recently noticed some packets coming in on port 22 (sshd) on my
>> external interface from the 192.168.1.0/24 network. I don't have any
>> local machines on this network and the packets are coming in on my
>> WAN interface (via my router). How is that possible? My understanding
>> was that this network was not routeable from the internet.
>
>
> It might still be routable within your ISP's backbone.
>
> It might also have changed its IP address due to reassembly of
> overlapping IP fragments.

Kevin,

Yes, I concur with Mr. G. Reassembly of overlapping IP packets is the most
likely cause.

Posted by Matthias Apitz on February 22, 2008, 2:47 am
If you were  Registered and logged in, you could reply and use other advanced thread options

>Dear all,

>I've recently noticed some packets coming in on port 22 (sshd) on my
>external interface from the 192.168.1.0/24 network. I don't have any
>local machines on this network and the packets are coming in on my WAN
>interface (via my router). How is that possible? My understanding was
>that this network was not routeable from the internet. I'm guessing
>someone is try to get at my sshd server. Below are the packets. Is
>there any way to get more info on where they are coming from?

>Feb 20 20:02:14 tti kernel: iptables chain hostile: IN=eth1 OUT=
>MAC=00:0e:0c:dd:73:16:00:11:6e:00:f9:70:08:00 SRC=192.168.1.126
>DST=172.16.251.61 LEN=228 TOS=0x10 PREC=0x00 TTL=47 ID=19109 DF
>PROTO=TCP SPT=38196 DPT=22 WINDOW=16022 RES=0x00 ACK PSH FIN URGP=0

>I'm using iptables on a 2.6 Linux box.

Kevin,
I saw such stuff once in my firewall *incoming* as well and I think
an IP pkg with such private range src addr may arrive if the dst addr
is correct, but of course no answer through Internet to that src addr
is possible.

        matthias

Similar ThreadsPosted
Strange ICMP packets September 15, 2005, 10:53 pm
strange exe trying to connect February 3, 2005, 3:19 pm
Strange access to an web server January 26, 2005, 8:46 pm
strange firewall behaviour March 19, 2005, 10:08 pm
Strange firewall behaviour April 13, 2006, 4:10 am
Strange Shorewall Log Entries April 15, 2006, 11:15 am
Strange ZoneAlarm Alerts July 4, 2006, 7:16 pm
Strange problem when using PPTP VPN through Cisco PIX October 21, 2005, 3:42 am
m0n0wall strange vpn ipsec problem December 1, 2005, 1:53 pm
Trouble - Strange behaviour on VPN to China May 4, 2006, 10:29 am

The site map in XML format XML site map

Contact Us | Privacy Policy