1

On reviewing the firewall log on my router (supplied by my fibre provider), I noticed a few curious entries. Several teardrop or derivative attacks, I'd expect to see things like this in the log from public addresses, but these appear to originate from within the network.

enter image description here

I understand what a teardrop attack is - using the fragment offset field to confuse a device during reassembly of tcp packets, thus causing denial of service in vulnerable devices. In this case the firewall appears to have blocked it.

I have a reasonable confidence that none of the devices within my network are compromised, I believe the device that was assigned this IP at the time was actually an android based phone. So, can a device accidentally generate a tcp packet that the firewall could interpret as a teardrop, or this more likely to be a spoofed Ip in the source address?

  • A count of '1' something is not an attack. Worry if you have hundreds of thousands. – Overmind Jul 19 '17 at 10:20
  • 1
    I'm well aware of that and i never said there was only one. – iainpb Jul 19 '17 at 10:29
2

This is inconclusive.

Because port 3702 is assigned to WS-Discovery :

Web Services Dynamic Discovery (WS-Discovery) is a technical specification that defines a multicast discovery protocol to locate services on a local network. It operates over TCP and UDP port 3702 and uses IP multicast address 239.255.255.250. As the name suggests, the actual communication between nodes is done using web services standards, notably SOAP-over-UDP.

So it can be anything in the Android(tablet, phone,etc) that make use of WD-Discovery. If you think none of the Android application should talk to any local web services, then you should carry out further investigation, e.g. turn off all application and turn on one by anytime to observe network behavior.

  • How can Android apps use ws-discovery? Is it the same as Network service discovery (NSD) – IgorGanapolsky Nov 27 '18 at 19:13
  • 1
    @IgorGanapolsky Android doesn't lock out application from using other local network discovery protocol. Nevertheless, as I mentioned, the risk is not conclusive. – mootmoot Nov 28 '18 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.