3

I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The message (with an artistically modified source IP) was:

"Alert - Intrusion Prevention - Smurf Amplification attack dropped - 192.168.1.19, 8, X1 - 255.255.255.255, 8 "

It only happened when the NIC card was enabled and/or when the laptop started up.

We went through various attempts to run TCPView on the laptop, searching for port 8 traffic as well as monitoring the Sonicwall appliance for spurious traffic and couldn't narrow it down. We booted to the Microsoft Security Sweeper CD and ran scans, ran Malware Bytes, etc. trying to figure out if some malware had gotten on the system, but all came up clean.

One thing we noticed when running TCPView was that the system appeared to be listening on port 80. I initially dismissed it as I'd installed Visual Studio 2010 and figured IIS Express or the like was probably running. Last night, however, I right-clicked on a folder in Explorer and noticed an option to insert an XSP Web Server there. A quick Google search clued me in as to what XSP was and that it was part of the MonoDevelop IDE that was recently installed to explore Mono development.

This morning I uninstalled MonoDevelop and restarted the laptop and - no warning email from the Sonicwall appliance came.

I wanted to get this info out there so that others that are suddenly battling with their IT department over a "potentially compromised system" can get a heads up on one possibility for the alerts. I'm also curious to know what XSP (or MonoDevelop?) is doing upon network initialization that incurs the Sonicwall's wrath.

Edit: Striking out the above. Apparently it wasn't XSP Server causing the issue as it is still happening when connecting to the network. Modified the title of the question to reflect this.

Improve this question
2
  • Well - so much for that theory. I just fired up my laptop and even with the MonoDevelop removed I just got a Sonicwall alert again about a Smurf Amplification Attack right after bootup. Appears it wasn't the XSP server after all. Any thoughts?
    – cpuguru
    Commented Jan 27, 2012 at 15:37
  • Have you tried to run a network sniffing tool such as wireshark on the network to see what traffic is being sent to the broadcast address from this laptop?
    – David Stubley
    Commented Jan 27, 2012 at 17:17

1 Answer 1

Reset to default
2

Have you verified that this is in fact a smurf attack? Are you receiving a lot of traffic?

Or is the IP address from the firewall actually your ip?

It would help to see a packet dump of the actual "attack". Someone has to be the victim here, and if it is you, you should see a flood of ICMP messages coming your way.

smurf.Powertech.no has a register of networks that has not been properly configured thus allowing the smurf attack. Quote from their site:

The SAR lets you probe Internet connected IP networks to see whether or not they are configured in a way that will allow perpetrators to use them for smurf amplification.

I think you should definitely start a packet dump ASAP and see if you can figure out where the traffic is coming from. It might be hard as a smurf attack is in theory spoofed, but a packet dump could perhaps give us some vital pointers.

Tcpdump command that might work in your case: 

tcpdump -w test.pcap udp port 8
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .