UDP Flood i to co widzi snort

[mickulek 0]

Ostatnio obrywam DOSem 60-120 mbit

 

Oto co widzi snort:

[**] [116:150:1] (snort decoder) Bad Traffic Loopback IP [**]
[Priority: 3] 
04/21-15:18:21.874529 127.187.146.63:30346 -> 91.121.58.13:80
TCP TTL:60 TOS:0x0 ID:8889 IpLen:20 DgmLen:60 DF
******S* Seq: 0xDEEC35A  Ack: 0x0  Win: 0x7D78  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 3290327 1543503872 NOP WS: 0 

[**] [116:150:1] (snort decoder) Bad Traffic Loopback IP [**]
[Priority: 3] 
04/21-15:18:28.422259 127.252.75.110:24759 -> 91.121.58.13:80
TCP TTL:60 TOS:0x0 ID:52440 IpLen:20 DgmLen:60 DF
******S* Seq: 0xD0FE7950  Ack: 0x0  Win: 0x7D78  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 681050 1560281088 NOP WS: 0 

[**] [116:150:1] (snort decoder) Bad Traffic Loopback IP [**]
[Priority: 3] 
04/21-15:18:28.473771 127.85.91.19:57582 -> 91.121.58.13:80
TCP TTL:60 TOS:0x0 ID:6473 IpLen:20 DgmLen:60 DF
******S* Seq: 0x30B0CC6C  Ack: 0x0  Win: 0x7D78  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 13046727 1493172224 NOP WS: 0 

[**] [116:150:1] (snort decoder) Bad Traffic Loopback IP [**]
[Priority: 3] 
04/21-15:18:28.601249 127.135.176.13:34164 -> 91.121.58.13:80
TCP TTL:60 TOS:0x0 ID:40055 IpLen:20 DgmLen:60 DF
******S* Seq: 0xA833D271  Ack: 0x0  Win: 0x7D78  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 12041067 1157627904 NOP WS: 0 

[**] [116:150:1] (snort decoder) Bad Traffic Loopback IP [**]
[Priority: 3] 
04/21-15:18:28.627090 127.213.152.25:57312 -> 91.121.58.13:80
TCP TTL:60 TOS:0x0 ID:46156 IpLen:20 DgmLen:60 DF
******S* Seq: 0xEBC1E350  Ack: 0x0  Win: 0x7D78  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 5652133 419430400 NOP WS: 0 

 

Czy ktoś z Was może powiedzieć mi co z tym zrobić?

Z góry dziękuje.

Pozdrawiam : )

[tomii 0]

Mogę się mylić ale może blokowanie po ip jeżeli ich dużo nie ma?

[mickulek 0]

Mylisz sie:

PING 127.213.152.25 (127.213.152.25) 56(84) bytes of data.
64 bytes from 127.213.152.25: icmp_seq=1 ttl=64 time=0.043 ms

 

czyli to rzeczywiście loopback.