1

I have a host on the Network that tries to send TCP/IP Packets to various servers. The DST Port is always 80 or 443 and the Flags set are RST and ACK. These Packets are blocked by our firewall. I did whois request for all target addresses and it where all addresses of the Google Cloud or Akamai. All 100 Request where sent within a secound. This happend several times.

My Suspicion now is that there are no further packets sent because the malware realized that the packets are blocked by the firewall. Is this a reasonable idea or is there a less malicious explaination for this behaviour?

// The questionable host is running windows 7.

Improve this question
2
  • What makes you think that the malware would know the packets were blocked by the firewall? if its sending a rst/ack packet to a host that actually has a web service its not likely it should expect any response in any circumstance (the server will either actually end the session or just shrug it off). So, it would only know, if your firewall sent some sort of indication that it was blocked like an ICMP destination rejection message. Either way, honestly I haven't seen any malware that cared much if its traffic was blocked. It just sends like crazy and lets god sort it out.
    – Jeff Meden
    Nov 14, 2016 at 17:02
  • These packets are blocked there is no response at all.
    – davidb
    Nov 14, 2016 at 17:08

1 Answer 1

Reset to default
1

I wrote a script that fetches the certificate from all hosts that where listed in the firewall with TCP:RA to port 443. The Results showed that ~70% of that hosts had certificates for *.dropbox.com and to some other cloud based solutions. Seemingly the connection of these clients had been reset by servers by sending a packet with the RST Flag set which terminated the State in the firewall. The firewall then blocked the RST,ACK Answer from the client. So no malware in most cases. One host was actually infected.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .