Solved

land attack

Posted on 2006-06-22
3
793 Views
Last Modified: 2008-01-16
i see an impossible ip packet alert being triggered on the cisco ips sensors.  the traffic is from and to one of the domain controllers on udp port 138.  this may be indicative of land attack but it is happening on a couple of servers.  also, the servers are properly patched and nothing malacious was detected on the servers.  the other servers are not DCs.

does anyone know more about this?

thanks,
netgeek
0
Comment
Question by:net-geek
  • 2
3 Comments
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 50 total points
Comment Utility
There are false positives with most IDS and IPS systems, but this error has occured with Snort IDS sig's in the past
http://www.snort.org/archive-3-1767.html
http://support.microsoft.com/kb/188001

They could be spoofed, if possible, install wireshark (formerly ethereal) on the pc's in question and see if they are actaully sending that data, or span the port of these pc's to a sniffer to see if they are infact comming from that pc.
The LAND attack is a variation on the SYN attack. In the LAND attack, instead of sending
SYN packets with IP addresses that do not exist, the flood of SYN packets all have the same
spoof IP address—that of the targeted computer. The LAND attack can be prevented by filtering
out incoming packets for which source IP addresses appear to be from computers on the internal
network
-rich
0
 

Author Comment

by:net-geek
Comment Utility
ok, thanks.
0
 
LVL 38

Expert Comment

by:Rich Rumble
Comment Utility
Were you able to confirm that the traffic was definatly comming from the source that your IDS said it was? Just curious.
-rich
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now