Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
965
Views
0
Helpful
3
Replies

suspicious traffic

pgamage
Level 1
Level 1

‎07-27-2012 11:06 PM - edited ‎03-04-2019 05:05 PM

We have 1M serial link. we noticed 1M up / down traffic. then we disconnected all LAN ports leaving only this serial link up. still we see 1M up/down traffic.

debug ip packet shows incomming and out going traffic.

How do we solve this porblem?

Please help.

Labels:
0 Helpful
3 Replies 3

John Blakley
VIP Alumni
VIP Alumni

‎07-28-2012 05:36 AM

Were you able to determine what port the traffic is trying to connect to? You should determine if it's the same source address trying to connect to the same port, or if it's different source addresses trying to connect to the same port or even different ports. This could be an indication of a DoS attempt or it could possibly be legitimate traffic. It's really hard to tell without having additional information.

HTH,

John

HTH, John *** Please rate all useful posts ***
0 Helpful

pgamage
Level 1
Level 1
In response to John Blakley

‎07-28-2012 04:28 PM

Debug ip packet shows 2 outbound packet originated from serial link IP, then 3 inbound packets come to the inside global NAT address.

This pattern repeats again and again. I don't understand how router generate this outbound traffic with source address of the serial interface.

Inbound - Internet IP to Inside Global NAT IP(66.66.66.66)

Outboud - Serial Interface(55.55.55.55) IP to Internet

Inbound

Jul 28 01:52:02.951:  IP: s=66.150.8.24, d=66.66.66.66, pak 296A9B9C consumed in input feature , packet consumed, MCI

Check(80), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Jul 28 01:52:03.259: IP: s=66.150.8.20 (Serial0/0/0), d=66.66.66.66, len 32, input feature, Virtual Fragment Reassemb

ly(25), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Jul 28 01:52:03.259: IP: s=66.150.8.20 (Serial0/0/0), d=66.66.66.66, len 32, input feature, Virtual Fragment Reassemb

ly After IPSec Decryption(39), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Outbound

Jul 28 01:52:03.259: IP: s=55.55.55.55 (local), d=66.150.8.20 (Serial0/0/0), len 56, sending

Jul 28 01:52:03.259: IP: s=55.55.55.55 (local), d=66.150.8.20 (Serial0/0/0), len 56, sending full packet

Inbound

Jul 28 01:52:03.259:  IP: s=66.150.8.20, d=66.66.66.66, pak 296A96E0 consumed in input feature , packet consumed, MCI

Check(80), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Jul 28 01:52:03.603: IP: s=66.150.8.24 (Serial0/0/0), d=66.66.66.66, len 32, input feature, Virtual Fragment Reassemb

ly(25), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Jul 28 01:52:03.603: IP: s=66.150.8.24 (Serial0/0/0), d=66.66.66.66, len 32, input feature, Virtual Fragment Reassemb

ly After IPSec Decryption(39), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Outbound

Jul 28 01:52:03.603: IP: s=55.55.55.55 (local), d=66.150.8.24 (Serial0/0/0), len 56, sending

Jul 28 01:52:03.603: IP: s=55.55.55.55 (local), d=66.150.8.24 (Serial0/0/0), len 56, sending full packet

Inbound

Jul 28 01:52:03.603:  IP: s=66.150.8.24, d=66.66.66.66, pak 2818D854 consumed in input feature , packet consumed, MCI

Check(80), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Jul 28 01:52:03.611: IP: s=66.150.8.32 (Serial0/0/0), d=66.66.66.66, len 32, input feature, Virtual Fragment Reassemb

ly(25), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Jul 28 01:52:03.611: IP: s=66.150.8.32 (Serial0/0/0), d=66.66.66.66, len 32, input feature, Virtual Fragment Reassemb

ly After IPSec Decryption(39), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Outbound

Jul 28 01:52:03.611: IP: s=55.55.55.55 (local), d=66.150.8.32 (Serial0/0/0), len 56, sending

Jul 28 01:52:03.611: IP: s=55.55.55.55 (local), d=66.150.8.32 (Serial0/0/0), len 56, sending full packet

Inbound

Jul 28 01:52:03.611:  IP: s=66.150.8.32, d=66.66.66.66, pak 296AA058 consumed in input feature , packet consumed, MCI

Check(80), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Jul 28 01:52:03.915: IP: s=66.150.8.20 (Serial0/0/0), d=66.66.66.66, len 32, input feature, Virtual Fragment Reassemb

ly(25), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Jul 28 01:52:03.915: IP: s=66.150.8.20 (Serial0/0/0), d=66.66.66.66, len 32, input feature, Virtual Fragment Reassemb

ly After IPSec Decryption(39), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Outbound

Jul 28 01:52:03.915: IP: s=55.55.55.55 (local), d=66.150.8.20 (Serial0/0/0), len 56, sending

Jul 28 01:52:03.915: IP: s=55.55.55.55 (local), d=66.150.8.20 (Serial0/0/0), len 56, sending full packet

0 Helpful

pgamage
Level 1
Level 1
In response to pgamage

‎07-28-2012 04:59 PM

There is a clear pattern.

Router recieve this

s=66.150.8.20    d=66.66.66.66 and replies with

s=55.55.55.55    d=66.150.8.20

Is router sending some message towards the soruce?

Formatted text of previous posting is like this.

In

s=66.150.8.24          d=66.66.66.66

s=66.150.8.20    d=66.66.66.66

s=66.150.8.20    d=66.66.66.66

Out

s=55.55.55.55    d=66.150.8.20

s=55.55.55.55    d=66.150.8.20

In

s=66.150.8.20    d=66.66.66.66

s=66.150.8.24    d=66.66.66.66

s=66.150.8.24    d=66.66.66.66   

Out

s=55.55.55.55    d=66.150.8.24

s=55.55.55.55    d=66.150.8.24

In

s=66.150.8.24    d=66.66.66.66

s=66.150.8.32    d=66.66.66.66   

s=66.150.8.32    d=66.66.66.66

Out   

s=55.55.55.55    d=66.150.8.32

s=55.55.55.55    d=66.150.8.32

In

s=66.150.8.32    d=66.150.8.32   

s=66.150.8.20    d=66.150.8.32

s=66.150.8.20    d=66.150.8.32

out

s=55.55.55.55    d=66.150.8.20

s=55.55.55.55    d=66.150.8.20

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking for a $25 gift card