We are seeing a large number of tcp connection attempts to ports known to have security issues. The source addresses are spoofed from our address range. They are easy to block at our border router obviously, but the number and volume is a bit worrisome. Our upstream providers appear to be uninterested in tracing or blocking them. Is this the new normal? One of my concerns is that if others are seeing probe attempts, they will see them from these addresses and of course, contact us.
Any suggestions on what to do next? Or just ignore.
* Matthew Huff:
We are seeing a large number of tcp connection attempts to ports
known to have security issues. The source addresses are spoofed from
our address range. They are easy to block at our border router
obviously, but the number and volume is a bit worrisome. Our
upstream providers appear to be uninterested in tracing or blocking
them. Is this the new normal? One of my concerns is that if others
are seeing probe attempts, they will see them from these addresses
and of course, contact us.
What's the distribution of the source addresses and source ports?
Yes, it's the new norm... same as the old norm... I'm surprised they didn't
try to upsell you on some type of managed DDoS solution...
Stefan Fouant
www.shortestpathfirst.net
GPG Key ID: 0xB5E3803D
The source address appears to be fixed as well as the source port (6666), scanning different destinations and ports.
Some script kiddies found nmap and decided to target you for some reason. It happens. It's annoying.
I'm not at all concerned about door-knob twisting or network scanning. What concerns me is that the source addresses are spoofed from our address range and that our upstream providers aren't willing to even look at the problem.
But that can be easy addressed by yourself.
just do not allow traffic originating from your range on your
external interfaces.