1

I woke up this morning and could see over 1000+ of these alerts.

They came in the time space 23:34 - 23:35.
Can anybody tell me what that was about and should I be worried for an eventual DDoS attack?

I am running pfsense and behind that box I have my LAN and a NIC where my server is in a separate environment.

Snort Alter

  • There isn't a lot for us to go on - the source port is 5060, which is SIP/VOIP, and it's coming from Portugal. Is there anything else you can tell us? – schroeder Mar 26 '15 at 21:22
  • In general, 1000 bad connections in a minute, which then stop, isn't that big of a deal. Without any further data, I might say that someone misconfigured their VOIP server for a moment. – schroeder Mar 26 '15 at 21:27
  • I have tried to identify the source and he is hiding behind a proxy. That is actually the only thing I know for sure. My firewall and system logs doesn't show any signs of brute force or any "bad Behavior" activity. – Daniel Guldberg Aaes Mar 26 '15 at 21:32
  • Most likely it was already blocked by the firewall before it even reached snort, so I don't think it's anything to worry about. If it were a DDos attempt, it would last a lot longer than 1 minute. Snort in general generates tons of alerts, most of which are safe to ignore. – tlng05 Mar 27 '15 at 1:56
1

This is probably a bad configured scanning(attempting) of the communications compagny in Portugal. Since the ip-range might be the same as yours. Or they misconfigured some other connection ip's.

Nevertheless i don't think this commucation compagny is trying to hack you. Unless you have valuable information ;).

Greets

Samuel

More info:

inetnum:        87.196.128.0 - 87.196.255.255
netname:        NOS
descr:          NOS COMUNICACOES S.A.
country:        PT
admin-c:        NVSA1-RIPE
tech-c:         NVST1-RIPE
status:         ASSIGNED PA
mnt-by:         IP-MNT
source:         RIPE # Filtered

Wikipedia Source Nos communications:

http://en.wikipedia.org/wiki/NOS_Comunica%C3%A7%C3%B5es

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.