-2

I'm kinda new in IT security and i'm analyzing some flows.

The only informations i have are : *ip dst *timestamp *port dst *numbers of sources and flows.

I noticed some suspicious flows coming from *********1e100.net. My suspicions are based on the facts that each timestamp is separated from the last by 21 seconds exactly, the destination IP addr is then different (but not random, its often the previous ip + 1)

This concerns 5 ou 6 following flows then it stops but it comes back few minuts after ( no pattern here ). Destination ports can be 80 or 443. When the port = 80, source = 1 and flows = 1 or 2. When the port = 443, source = 1 and flows = 2 or more.

I have no clue of what it can be and i should already apologize for my english level.

Thank you for your help !

  • Not sure if I get you right: Is a google-owned host regularly visiting your website? Or are users on your net visiting google-owned services? In the former case, you might offer a sufficiently remarkable content with a caching/expiry tie interval of 20 seconds – Hagen von Eitzen Mar 31 '15 at 15:15
2

Short answer: You're flows are identifying any traffic to any google operated servers on the internet.

Longer answer:

What quack's link is saying is that every google owned IP address resolves to the 1e100.net domain.

$ dig +short www.google.com
74.125.239.52
74.125.239.48
74.125.239.49
74.125.239.51
74.125.239.50
$ dig +short -x 74.125.239.52
nuq04s19-in-f20.1e100.net.

Your question as to what is causing this - with the information you've provided it can be anything that contacts google servers.

Just about every web page has google analytics installed, gmail, google search, google appengine, blogspot, and google compute are all services operated by google, and some of them are running software installed by anyone (blogspot, appengine, compute).

Giving us 1e100.net is equivalent to saying I noticed something on my network contacting the internet, and the internet is suspicious. Can you help me figure out what it is? Not with the info you provided.

If you want to trap it - turn off outbound 80 & 443, install squid (transparent, SSL MITM), and watch what systems are actually doing.

Another quicker and more labor intensive way is to watch your DNS requests. Start to track what Domain Names (host names) the systems are calling, and map them to the IPs that reverse lookup to the *.1e100.net you're curious about.

It's DNS

but not random, its often the previous ip + 1

That's how systems use DNS results that have more than one IP for the host name. See my previous DNS query for google.com - there were 5 IPs returned and my system will use the first one, then the second, then the third, then .. you get the point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.