Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

Question

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these automated scans, PC's with malware or are we under some kind of attack?

Most of these Ip's are not from the United States, I've seen Russia, S. Korea, and Pakistan plus other countries. I deleted the log and it instantly started filling back up.

Also what should be the next step, I'm going to see if this firewall has some kind of a log that shows connections inside trying to go out, or active connections. It's a Zywall USG 50.

update

It's been an hour and firewall has been hit 289 times, that doesn't count multiple packets being dropped (as in drop= 2,3,4ect).

update 2

so the only weird thing I can find, is weird UDP traffic on port 80 for the DMZ that I did not set up. I'll speak with the client's tomorrow and see if they know what is on the DMZ (they will not smh). Other then that I do have a large ammount of traffic hitting the firewall on port 53 but no of the active connections/sessions or data I logged on the network seem to point to anything.

Answer 1

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic:

• Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not actually hosting a website.
• Misconfigured systems. Computers are finicky things, and it's easy to accidentally start bothering another user's servers.
• Script kiddies. Some attackers will blast a large number of potential targets, hoping to hit an unpatched system.

Port 53 is used for DNS. It's possible that somebody is simply mapping out DNS servers. It's also possible that an attacker is trying to exploit your systems - as long as you're up-to-date on patches, though, it's a non-issue.

So to reiterate, I wouldn't worry about this at all. You should get concerned if you start seeing enough incoming requests to constitute a denial of service, though.

Answer 2

How to diagnose if you are under a brute scan or a targeted attack?

If you have the possibility to do so, keep free a specific public @IP within your network. Register it correctly on the DNS as a typical name for a web server. But don't attribute this @IP to any real machine within your network. I mean don't go as far as to create a honey pot, just create a trap @IP.

Next insert a specific rule on your firewall to block and log any traffic toward this @IP (something like deny ip any any log).

IF you get a lot of traffic toward this trap @IP,

THEN you are the target of scanners or the target of scanners before a real attack,

look at the typical ports scanned on your trap @IP so as to be able to eliminate them of your firewall log files to focus on real attacks

ELSE you are most probably under a more targeted attack.

Answer 3

It is difficult to know whether you are being targeted specifically. It is very likely that you are getting hit with automated scans that can be ignored as long as you have configured your firewall to block all incoming traffic. Phishing attacks and outbound connections to malicious sites are much more serious as they are more likely to succeed. Here is a good guide on popular types of attacks that are successful and thus widely employed: http://www.verizonenterprise.com/DBIR/

1. Keep your firewall patched
2. Use other security products like IDS/IPS/SIEM to watch for anomalies