Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm sure no daemon or browser is using network resources, but I found incoming packets from Wireshark:

98.126.43.174 source port 80 --TCP--> MyIp destination port 339 [SYN, ACK]
98.126.43.174 source port 80 --TCP--> MyIP destination port 339 [SYN, ACK]
67.11.225.49 source port 27725 --UDP--> MyIP destination port 10112
67.11.225.49 source port 27725 --UDP--> MyIP destination port 10112

I've setup deny all incoming packets in my firewall. But it seems that my firewall configuration still allow incoming from TCP port 80 and incoming to UDP port 10112.

I'm sure my IP is not initiating any connection to port 80 to that IP. I also don't have any daemons that will respond to port 339.

My question is how attacker benefits by sending packet from source port 80? What is the risk? Where can I find more detail about this kind of attack?

REVISE:

If I didn't block this packet by using stateful firewall and keep replying with [SYN, ACK] as defaults, what is the worst risk that could happen?

share|improve this question
    
Are you sure your firewall is configured properly? –  Lucas Kauffman Jan 22 '13 at 17:45
    
@Lucas Kauffmaan: Yes, I think so because firewall already blocked many incoming to SSH and SMTP port. –  newbie Jan 22 '13 at 17:49
    
@DavidStratton or any webserver for that matter –  Lucas Kauffman Jan 22 '13 at 17:51
    
@DavidStratton the link show information for port 1012 but in my case, the UDP incoming packet's destination is port 10112. –  newbie Jan 22 '13 at 17:54

1 Answer 1

up vote 4 down vote accepted

Since the first two packets are SYN+ACK, they look like a response to a connection attempt: the server on 98.126.43.174 might be a totally honest and genuine Web server, who received a connection request (a SYN packet) on port 80, which, from the point of view of that server, was coming from your IP (and port 339). It is possible that the server 98.126.43.174 is currently under a SYN flood attack and the attacker selects random IP and ports for each of its malicious SYN packets; in that case, your IP was randomly selected as purported source for one of the SYN packets.

As for the firewall, some simply block basic SYN packets, i.e. the first packet in the TCP three-way handshake. These firewalls rely on your OS to drop all others since your OS never received the initial packet to start with. This would explain why these packets reach your machine: the firewall lets them pass because it knows that the packets will be either legitimate (follow-up on a SYN packet you sent) or harmless (if you did not send a SYN packet).

As for the UDP packets, they might be responses to previous requests. Some software use a lot of UDP with randomly selected ports, Skype being the usual suspect.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.