127.0.0.1

[altis]

Here's a snip from the log of my NAT router from last night:

Tue, 27 Jan 2004 22:41:21 GMT+0000 Unrecognized access from 127.0.0.1:80 to TCP port 1143
Tue, 27 Jan 2004 23:00:34 GMT+0000 Unrecognized access from 127.0.0.1:80 to TCP port 1787
Tue, 27 Jan 2004 23:09:10 GMT+0000 Unrecognized access from 65.35.22.107:3458 to TCP port 17300
Tue, 27 Jan 2004 23:13:01 GMT+0000 Unrecognized access from 68.45.110.12:2755 to TCP port 901
Tue, 27 Jan 2004 23:21:53 GMT+0000 Unrecognized access from 127.0.0.1:80 to TCP port 1515
Tue, 27 Jan 2004 23:42:31 GMT+0000 Unrecognized access from 127.0.0.1:80 to TCP port 1175
Tue, 27 Jan 2004 23:45:18 GMT+0000 Unrecognized access from 211.23.120.65:4372 to TCP port 4899
Tue, 27 Jan 2004 23:50:43 GMT+0000 Unrecognized access from 127.0.0.1:80 to TCP port 1201
Wed, 28 Jan 2004 00:26:51 GMT+0000 Unrecognized access from 65.65.221.2:3767 to TCP port 17300
Wed, 28 Jan 2004 00:41:20 GMT+0000 Unrecognized access from 67.71.46.127:3016 to TCP port 17300
Wed, 28 Jan 2004 00:45:02 GMT+0000 Unrecognized access from 127.0.0.1:80 to TCP port 1303

Now I understand that 127.0.0.1 is the network loopback address so how does it end up in the log? At the time, there were no PCs switched on - just the router.

Puzzled...

[Nemesis]

Originally Posted by altis

Here's a snip from the log of my NAT router from last night:


Now I understand that 127.0.0.1 is the network loopback address so how does it end up in the log? At the time, there were no PCs switched on - just the router.

Puzzled...

It's also known as 'localhost', but interesting log ...

[rdhw]

Originally Posted by altis

Tue, 27 Jan 2004 22:41:21 GMT+0000 Unrecognized access from 127.0.0.1:80 to TCP port 1143
Tue, 27 Jan 2004 23:00:34 GMT+0000 Unrecognized access from 127.0.0.1:80 to TCP port 1787

These are malicious probes where the source IP address has been "spoofed": deliberately set to a false value, something other than the true sender. Certain NAT routers can be compromised by such incoming packets, because they construct a reply to themselves, 127.0.0.1.

[altis]

This prompts me to ask two questions:
1) Is the sender trying to achieve anything other than tie my router in knots (and if so, how can they expect a reply)?
2) Should NTL be passing me packets that have so obviously been spoofed?

[rdhw]

Originally Posted by altis

1) Is the sender trying to achieve anything other than tie my router in knots (and if so, how can they expect a reply)?

They certainly will not get a reply to the probe. The intention of the probe might be Denial of Service (crash the router), or maybe a carefully crafted probe, causing the router to reply to its own web configuration interface, might disable the router's security settings so that a later probe could take control of it. If such a thing were possible, it would likely be specific to one model of router.

2) Should NTL be passing me packets that have so obviously been spoofed?

It's debatable what ISPs should or should not be doing in this area. NTL have started blocking certain ports which are commonly used by malicious probes, it would be a small extra step to filter out probes from obviously bogus source addresses. But the onus is really on the end-user to protect themselves, and no-one should rely on an ISP to do it for them (as a child might rely on a nanny). NTL's port-blocking can be seen as more of an attempt to prevent their network being overrun by worms, as much as an attempt to help the home user.

[Ramrod]

On that note, can anyone tell me who or what 192.168.0.1. is?

[Nemesis]

Originally Posted by Ramrod

On that note, can anyone tell me who or what 192.168.0.1. is?

Private address space

see here

http://www.shmoo.com/mail/firewalls/...msg00016.shtml

[rdhw]

Originally Posted by Ramrod

can anyone tell me who or what 192.168.0.1. is?

The most likely candidate is your router itself.

[zendawn]

Originally Posted by rdhw

The most likely candidate is your router itself.

127.0.0.1 is the number Fast Cache asks you to set your DNS (or TCP?) to.
Not sure if that helps.

[Stuartbe]

Originally Posted by altis

This prompts me to ask two questions:
1) Is the sender trying to achieve anything other than tie my router in knots (and if so, how can they expect a reply)?
2) Should NTL be passing me packets that have so obviously been spoofed?

Trouble is that spoofed packets can be generated to apear as they are from other sources as well as a loopback address.

The only way you can truly block these packets is to filter them as they leave the BGR of the isp. After this piont it is hard to identify them correctly.

If every isp in the world did this most dos, ddos and all rddos attacks would stop and the net would be a far better place.

Just my 2p's worth !

[Ramrod]

Originally Posted by Nemesis

Private address space

see here

http://www.shmoo.com/mail/firewalls/...msg00016.shtml

any idea what that means?

[Ramrod]

Originally Posted by zendawn

127.0.0.1 is the number Fast Cache asks you to set your DNS (or TCP?) to.
Not sure if that helps.

*off topic* nice yinyang zen

[altis]

Originally Posted by Ramrod

any idea what that means?

Every computer on the internet has a unique IP address except those that are in the range 10.*.*.* or 192.168.*.*. There can be many computers (or appliances) with the address 192.160.0.1 because it its in one of these ranges that are reserved for local addressing. If you type 192.168.0.1 into your browser you will only address your local computer/appliance - all others will be on the other side of your router.

[Ramrod]

Originally Posted by altis

Every computer on the internet has a unique IP address except those that are in the range 10.*.*.* or 192.168.*.*. There can be many computers (or appliances) with the address 192.160.0.1 because it its in one of these ranges that are reserved for local addressing. If you type 192.168.0.1 into your browser you will only address your local computer/appliance - all others will be on the other side of your router.

Should I tell my firewall to allow this traffic?

[rdhw]

Originally Posted by Ramrod

Should I tell my firewall to allow this traffic?

If you have a router (or a Windows ICS) and if its IP address is 192.168.0.1, then, yes, you can allow it to talk to you through your firewall.