I need a little help guys

Kaptan647

Kaptan647

Retired Staff
Contributor
Apr 25, 2015
314
395
112
Recently some one was attacking my servers. It was a weird attack. He was using a protocol i have never seen before. and he was spoofing his ip. The weird thins is when i used tcpdump for logs it shows different ips but all the ips had same feature. "19:27:52.297061 IP (tos 0x0, ttl 53, id 766, offset 0, flags [DF], proto unknown (84), length 60)" this log must be different for every ip but for some reason it was same and ips were different. Some how he was sending interrupt signals to use my cpu. So my question is any one know any thing about TTP protocol (Transaction Transport Protocol) ?I couldn't find any information about this protocol.
 
Derp

Derp

Retired Staff
Contributor
Apr 30, 2015
933
1,014
217
Kaptan647 said:
shows different ips but all the ips had same feature. "19:27:52.297061 IP (tos 0x0, ttl 53, id 766, offset 0, flags [DF], proto unknown (84), length 60)
Click to expand...

If that's the case, the attacker is using a specified Attack Method.

I think he's targeting one(or more) of the services you are running in your machine (Not talking about teamspeak or web-server).

Check where the traffic is coming from, and what port it's targeting, Then check if any service you run listens for incoming connections to that port.
 
Last edited:
Kaptan647

Kaptan647

Retired Staff
Contributor
Apr 25, 2015
314
395
112
Derp said:
If that's the case, the attacker is using a specified Attack Method.

I think he's targeting one(or more) of the services you are running in your machine (Not talking about teamspeak or web-server).

Check where the traffic is coming from, and what port it's targeting, Then check if any service you run listens for incoming connections to that port.
Click to expand...

i have alreaddy checked it
gA2MgZ.png

Asphyxia said:
Do you use JUNIPER firewalls by chance or does your host? http://www.experts-exchange.com/Hardware/Networking_Hardware/Firewalls/Q_28654202.html
If they do, that could be the issue. They might be targeting your server, in the process fucking with the firewall of your server(s). :confused:
Would need to know more info: what services you have running (versions also), what OS and what provider you are using.
Click to expand...
No i dont use Juniper firewall.I am using centos my provider is this http://www.dgn.net.tr/ . It is a datacenter located in Turkey.
 
ehthe

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,029
896
216
You mean your network card was receiving so much shit it hogged your cpu with interrupts :)
That is not the same thing at all.
 
Kaptan647

Kaptan647

Retired Staff
Contributor
Apr 25, 2015
314
395
112
ehthe said:
You mean your network card was receiving so much shit it hogged your cpu with interrupts :)
That is not the same thing at all.
Click to expand...
Maybe :) i am not sure. All i know is even when i blocked ips with firewall my cpu was %90-98 for 30 mins and i had 10 ksoftirqd procsess
 
You must log in or register to reply here.
Top