Was someone trying to attack me?

sfamonkey · **on:** July 19, 2004, 12:05:33 PM

A couple days ago I think someone tried to attack me.

The log looked like this:
172.0.0.1:1005
172.0.0.1:1006
and the port numbers just changed at changed.

Rafi · **Reply #1 on:** July 19, 2004, 05:31:26 PM

you can ban the attacker's IP!

sfamonkey · **Reply #2 on:** July 19, 2004, 09:08:13 PM

I wanted to but when the ip was like 172.0.0.1:1250 it stayed there for like a sec and a new port was there and it kept changing ports so I couldn't block them.

TGeRi · **Reply #3 on:** July 21, 2004, 04:32:45 AM

""

Special-Use Addresses

Several address ranges are reserved for "Special Use". These addresses all have restrictions of some sort placed on their use, and in general should not appear in normal use on the public Internet. The following briefly documents these addresses – in general they are used in specialized technical contexts. They are described in more detail in RFC 3330.
"Private Use" IP addresses:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255

The above address blocks are reserved for use on private networks, and should never appear in the public Internet. There are hundreds of thousands of such private networks (for example home firewalls sometimes make use of them). The IANA has no record of who uses these address blocks. Anyone may use these address blocks within their own network without any prior notification to IANA.

The point of private address space is to allow many organizations in different places to use the same addresses, and as long as these disconnected or self-contained islands of IP-speaking computers (private intranets) are not connected, there is no problem. If you see an apparent attack, or spam, coming from one of these address ranges, then either it is coming from your local environment, or the address has been "spoofed".
""

(from: http://www.iana.org/faqs/abuse-faq.htm#StructureofIPAddresses)

So this is very strage but still, i think u can ban "whole" 172.0.0.1 without setting the porty so then all the ports for that ip will be banned.

Please correct me if i am wrong.

Rafi · **Reply #4 on:** July 21, 2004, 04:45:40 AM

Yes, that's what I sugested. And make sure it is not from one of your own PCs on your internal net (if you have one).

BTW - I'm not sure what is the format to define baned IP ranges

rejetto · **Reply #5 on:** July 21, 2004, 01:18:36 PM

1) 172.0.0.1 is not in the range 172.16.0.0 - 172.31.255.255

2) 172.0.0.1 is very similar to 127.0.0.1 ...are you sure it ws 172 and not 127 ?

3) the remote port is changing at each connection, yes, it is normal, it always happens, with any server software. that is not your port, and it is unimportant to you.

4) that port changes, and you can still ban it. the IP address does not include the port. it is the TCP address that includes the port. When you ban someone you ban the IP address, specifying NOT the port.
anyway, in HFS you can ban using wildcards, like 195.31.* and it will ban the whole class.

Rafi · **Reply #6 on:** July 21, 2004, 06:19:35 PM

Quote from: "rejetto"

anyway, in HFS you can ban using wildcards, like 195.31.* and it will ban the whole class.

So how can you ban, for your example :
172.16.0.0 - 172.31.255.255 ? 16 lines ?

May be in some future version you can add a from-to range possibility.

rejetto · **Reply #7 on:** July 22, 2004, 12:00:48 PM

7, not 16
because you can use 172.2?.*

Rafi · **Reply #8 on:** July 22, 2004, 03:01:16 PM

Quote from: "rejetto"

7, not 16
because you can use 172.2?.*

Wise guy...

and how many lines for 172.11.0.0 - 172.38.0.128 ?

rejetto · **Reply #9 on:** July 22, 2004, 11:40:42 PM

Quote from: "Rafi"

Wise guy... and how many lines for 172.11.0.0 - 172.38.0.128 ?

what quiz show is this? :shade:

Rafi · **Reply #10 on:** July 23, 2004, 06:25:35 AM

Quote from: "rejetto"

Quote from: "Rafi"
Wise guy... and how many lines for 172.11.0.0 - 172.38.0.128 ?
what quiz show is this? :shade:

Not a quiz show... a promotion for adding support for IP-range ban

A.: 26 :?:

It is realy not so important...

rejetto · **Reply #11 on:** July 25, 2004, 02:58:36 PM

IP ranges will be supported

AwPhuch · **Reply #12 on:** September 28, 2004, 09:05:14 PM

How bout getting a good firewall!?!?

http://www.smoothwall.org

Brian
AwPhuch

Mr. Anon · **Reply #13 on:** September 28, 2004, 10:55:04 PM

A firewall would not help if you decide to open a port to the Internet.
That means either you close access to the external Internet or allow access and risk being attacked. For now, HFS is not suspectable to known attacks.