Author Topic: Invalid TCP Source Port Attack?  (Read 1790 times)

0 Members and 1 Guest are viewing this topic.

BliZZa

  • Online Villain
  • ***
  • Posts: 140
    • View Profile
Invalid TCP Source Port Attack?
« on: May 27, 2004, 06:35:52 pm »
....anyone can say me what this is?
its the 2nd time i got "attacked"

both "attacks" came from the U.S.

both "attackers" got tracked by my firewall

one from san jose the other one from woburn

BliZZa

  • Online Villain
  • ***
  • Posts: 140
    • View Profile
Invalid TCP Source Port Attack?
« Reply #1 on: June 09, 2004, 02:43:13 pm »
noone of you knows something bout such attacks  :cry:

M. O.

  • Administrator
  • MasstKer
  • *
  • Posts: 9184
    • View Profile
    • http://www.tkc-community.net
Invalid TCP Source Port Attack?
« Reply #2 on: June 09, 2004, 02:55:09 pm »
No idea, the name is a bit strange, "Invalid TCP Source Port Attack", then is there a Valid one too? Try google for TCP Attack/TCP Port Attack, never heard about it before anyway.
Heckling is an art, and game hacking a science.

burrow100

  • Relentless Teamkiller
  • **
  • Posts: 95
    • View Profile
Invalid TCP Source Port Attack?
« Reply #3 on: June 10, 2004, 07:15:10 am »
i get it once and a while but usually its from my own ip address pinging not sure why it doea that but i have seen it by my firewall.
to boldly go  where no man has gone before.




Vicious

  • Old Guard
  • Master Heckler
  • *****
  • Posts: 2810
    • View Profile
Invalid TCP Source Port Attack?
« Reply #4 on: June 10, 2004, 07:25:51 am »
burrow, do you have any other computer sharing the internet with yours?
Innocence proves nothing

BliZZa

  • Online Villain
  • ***
  • Posts: 140
    • View Profile
Invalid TCP Source Port Attack?
« Reply #5 on: June 10, 2004, 09:13:00 pm »
i m receiving such attacks nearly every day now.

from several IP-adresses

brasil

dallas

phillipines

woburn

i think that arnt the reel locations of the attacker

i only once got a info that the attacker which was looged in via dallas

must be from San Jose/california.


i know those attacks arent a big risk as long my firewall is on.

a buddy of mine from the US  has spoken to  the internet company in
dallas for me to get more info and they told him the attacker tries to send me packages to get acces to my machine.But they also said he must be an absolute n00b which doesnt really know what he does.

BliZZa

  • Online Villain
  • ***
  • Posts: 140
    • View Profile
Invalid TCP Source Port Attack?
« Reply #6 on: June 10, 2004, 09:15:32 pm »
Invalid TCP Source Port
Severity: Low

This attack poses a minor threat. Corrective action may not be possible or is not required.

Attack Category: Suspicious Activity

Anomalous network conditions or traffic patterns. A suspicious activity signature, for example, might detect two systems with identical IP addresses, a condition that indicates an attempted IP spoofing attack.

Description

This attack signature detects packets with a TCP source port of 0. 0 is an invalid value for the TCP source port and must not be used.

Attackers sometime send TCP packets with a source port of 0 as a means of fingerprinting/profiling your operating system.

False Positive

None.



thats what the FW says but i dont really get it.

ZOldDude

  • The Unknown Rank!
  • Administrator
  • MasstKer
  • *
  • Posts: 20874
  • Old School TKC
    • View Profile
    • Admin
Invalid TCP Source Port Attack?
« Reply #7 on: June 10, 2004, 10:56:34 pm »
It means the guy is NOT getting into your computer.

I don't bother to log these things any longer or all my time online would be used to trace IP #s!

I use 3 differant firewalls and 3 AV programs along with changeing computer ID and product ID's and can change my IP address when ever I want.

I don't bother to do this as often as in the past unless I have a admin on VC ban me just becuase I am a Mod on this board.

*While we crash and burn, small, low tech, agrarian societies such as the Hmong in the mountains of Laos will continue on without so much as blinking an eye.*

BliZZa

  • Online Villain
  • ***
  • Posts: 140
    • View Profile
Invalid TCP Source Port Attack?
« Reply #8 on: June 10, 2004, 11:44:05 pm »
does it mean you get the same shit?

i ve blocked his IP s but hes usin always new ones.
so i ve just to ignore the alarms caus i cant do anything against?

i m curious what this guy wants from me.as the attacks begun i was very confused caus they started a few days after the old TKCsite went down.

M. O.

  • Administrator
  • MasstKer
  • *
  • Posts: 9184
    • View Profile
    • http://www.tkc-community.net
Invalid TCP Source Port Attack?
« Reply #9 on: June 11, 2004, 02:06:09 am »
It could be some program/virus or bot scanning for open ports. As you say there is no reason to "attack" you (esp if the attacks fail).
Heckling is an art, and game hacking a science.

ZOldDude

  • The Unknown Rank!
  • Administrator
  • MasstKer
  • *
  • Posts: 20874
  • Old School TKC
    • View Profile
    • Admin
Invalid TCP Source Port Attack?
« Reply #10 on: June 11, 2004, 02:46:01 am »
Haveing the program tell you it has STOPED somthing only lets you know it was doing it's job.

It will NEVER tell you that it failed....so turn OFF the pop-up!

Also turn off the logs.....save your disk space becuase if some body does get in they are going to do what they want and your logs will go on holiday and will not do you any good.

*While we crash and burn, small, low tech, agrarian societies such as the Hmong in the mountains of Laos will continue on without so much as blinking an eye.*

ZOldDude

  • The Unknown Rank!
  • Administrator
  • MasstKer
  • *
  • Posts: 20874
  • Old School TKC
    • View Profile
    • Admin
Re: Invalid TCP Source Port Attack?
« Reply #11 on: May 06, 2015, 09:20:00 pm »
Reading old posts....

My newest corporate firewall looks for IP's that ping ports (rotating ports) looking for an open one and auto-blocks it/them for 6 mins.

I also get Universities doing general IP surveys for ICMP and Ports 8 and 128 all the time that show up in the PeerGuard logs.

*While we crash and burn, small, low tech, agrarian societies such as the Hmong in the mountains of Laos will continue on without so much as blinking an eye.*

MrMedic

  • MasstKer
  • ********
  • Posts: 8900
  • programmer/dev/software engineer
    • View Profile
Re: Invalid TCP Source Port Attack?
« Reply #12 on: May 07, 2015, 12:58:29 pm »
looks like something sniffing for open ports , maybe a crawler.

easy to block
EnCoded Message: i3iy9yl8kr2xf3g2Txs3pr6ye3ya7jg5ty2z

https://www.youtube.com/watch?v=62_7-AYfdkQ
you need a paypal account for the private versions.

Website:
http://bit.ly/medic101

Teamspeak 3: 85.236.101.5:10157

ZOldDude

  • The Unknown Rank!
  • Administrator
  • MasstKer
  • *
  • Posts: 20874
  • Old School TKC
    • View Profile
    • Admin
Re: Invalid TCP Source Port Attack?
« Reply #13 on: May 07, 2015, 07:14:41 pm »
I get a lot of this from China and Russia.


*While we crash and burn, small, low tech, agrarian societies such as the Hmong in the mountains of Laos will continue on without so much as blinking an eye.*