Jump to content

Life like Opossum

Active Members
  • Posts

    78
  • Joined

  • Last visited

Posts posted by Life like Opossum

  1. Today my internet access started to act a little... strange. As usual, I checked my router to see if everything was ok. There were no extra DHCP leases besides the devices I would expect to be connected (One strange one was on, I assumed it to be my laptop as it shared the same mac) (I dual boot windows and backtrack on it).. Upon going into my logs for the router I saw that I am receiving ACK packets from a few different IP addresses. Is his something I should be concerned about or is it benign? Regardless, I set incoming rules to deny each of the addresses shown in the picture attached.

    Is my router being targeted by someone? If so, are there any suggestions anyone may have on what I can do? This whole situation has me a bit worried.

    To be safe I also ran full system scans for all and any malware, spyware etc. I have also disabled my hosting as of now and I am carefully monitoring all traffic on my network. If more information is needed, just let me know what you guys need and I will grab it for you ASAP.

    Currently I have WPS off, admin pass is separate from my Wi-Fi pass, and both passwords are a minimum 12 characters w/ upper and lowercase characters, special characters and numbers. Login captchas are enabled so brute forcing isn't likely an option, although I don't feel that is the goal here...

    (this isn't actually from June, my Date and Time are off on the router)

    Jun 4 23:42:41 notice Blocked incoming TCP packet from 206.217.211.219:80 to XXXXXX with unexpected sequence

    Jun 4 23:34:35 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:28:44 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:27:28 info version 1.0 started

    Jun 4 23:23:29 info using nameserver 64.59.135.145#53

    Jun 4 23:23:29 info using nameserver 64.59.128.114#53

    Jun 4 23:23:29 info reading /etc/resolv.conf

    Jun 4 23:23:13 info Lease of XXXXXX obtained, lease time 171455

    Jun 4 23:22:35 info version 1.0 started

    Jun 4 23:18:51 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:18:39 notice Blocked incoming TCP SynAck packet from 186.206.248.238:51413 to XXXXXX with unexpected sequence

    Jun 4 23:18:36 notice Blocked incoming TCP SynAck packet from 190.201.83.160:29466 to XXXXXX with unexpected sequence

    Jun 4 23:18:32 notice Blocked incoming TCP SynAck packet from 124.43.23.33:53456 to XXXXXX with unexpected sequence

    Jun 4 23:18:14 info UDHCPD sending OFFER of 192.168.0.102

    Jun 4 23:18:14 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:18:14 info UDHCPD sending OFFER of 192.168.0.102

    Jun 4 23:17:55 notice Blocked incoming TCP SynAck packet from 96.48.129.133:25622 toXXXXXX with unexpected sequence

    Jun 4 23:17:50 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:17:32 notice Blocked incoming TCP SynAck packet from 124.43.23.33:53456 to XXXXXX with unexpected sequence

    Jun 4 23:17:32 notice Blocked incoming TCP SynAck packet from 124.43.23.33:53456 to XXXXXX with unexpected sequence

    Jun 4 23:17:30 notice Blocked incoming TCP SynAck packet from 124.43.23.33:53456 to XXXXXX with unexpected sequence

    Jun 4 23:15:56 info UDHCPD Inform: add_lease 192.168.0.103

    Jun 4 23:15:52 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:52 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:25 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:25 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:25 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:25 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:25 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:25 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:25 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:25 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:25 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:25 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:25 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:25 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:25 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:25 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:24 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:24 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:24 info UDHCPD Inform: add_lease 192.168.0.101

    Jun 4 23:15:24 info UDHCPD Inform: add_lease 192.168.0.101

    Jun 4 23:15:24 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:24 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:24 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:24 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:24 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:24 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:24 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:24 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:24 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:23 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:23 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:23 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:23 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:23 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:23 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:23 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:22 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:22 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:22 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:22 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:22 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:22 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:22 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:22 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:22 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:22 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:21 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:21 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:21 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:21 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:21 info UDHCPD sending OFFER of 192.168.0.103

    Jun 4 23:15:21 info UDHCPD sendOffer : device_lan_ip=192.168.0.1 , device_lan_subnet_mask=255.255.255.0

    Jun 4 23:15:20 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:20 info UDHCPD Inform: add_lease 192.168.0.100

    Jun 4 23:15:19 info UDHCPD Inform: add_lease 192.168.0.103

    Jun 4 23:15:19 notice Blocked incoming TCP packet from 206.217.211.219:80 to XXXXXX with unexpected sequence

    Jun 4 23:12:00 notice Blocked incoming TCP SynAck packet from 190.201.83.160:29466 to XXXXXX with unexpected sequence

    Jun 4 23:10:18 notice Blocked incoming TCP SynAck packet from 190.201.83.160:29466 to XXXXXX with unexpected sequence

    Jun 4 23:09:23 notice Blocked incoming TCP SynAck packet from 190.201.83.160:29466 to XXXXXX with unexpected sequence

    Jun 4 23:09:23 notice Blocked incoming TCP SynAck packet from 190.201.83.160:29466 to XXXXXX with unexpected sequence

    EDIT: Removed Image

    EDIT: Added full log

    EDIT: Removed my IP (XXXXXX) =P

  2. So last year my father past away and my family had a memorial DVD made. Just of some pictures of him and some music. My brother and sister have both expressed interest in having a copy of this DVD, so I happily obliged and made copies. Sadly, my brother and sister are not the most technically inclined and cannot figure out how to run the video. This is where my problem lies.

    I know how to write an auto run, but not for MAC. This isn't the biggest issue however. The DVD does not contain any .exe files, thus I cannot point an auto run at any files in the DVD itself. What I need is an .exe file that will execute the path "\VIDEO_TS\VTS_01_1.VOB". I can handle the auto run but I do not know enough about .exe files to write an .exe for this.

    My next issue is that of the Mac. I do not know how to write an auto run or an executable file for Mac OS. The file path is again the same here; \VIDEO_TS\VTS_01_1.VOB is the file that needs to be executed.

    Lastly, is it possible to have both an .exe for windows and an .exe for mac (or its equivalent) on the same disc without causing any interference? That is, if the disc is inserted into a Mac or Windows machine the disc will auto run with no problems. Also, the disc currently works when placed into a DVD player. Will writing .exe and auto run files to the disc cause it to no longer run in a DVD player?

    I hope I am clear enough on this. It would mean a lot to me if anyone here could help me solve this issue.

  3. Hmm so, I have spent quite some time working on this issue and I have not been able to make any real progress as far as getting better speeds...

    I have done a factory reset on the router

    I have updated to the latest firmware

    Updated all my pc's to the latest bios versions

    Updated windows

    Updated Firfox

    Ensured all Linux kernels were up-to-date

    Nothing I seem to have done has had any effect.

    I enabled QOS on the router

    Removed all QOS rules and left QOS enabled

    Still no effect

    Sent data over LAN, got speeds of 80-120 MBps

    Sent data over WLAN, got speeds of 7-10 MBps

    So.. streaming data seems to be ok... maybe I'll try streaming another video online... cannot stream at quality higher than 360p on WLAN or LAN.

    It also seems that my router is causing me to receive drastically reduced network speeds.When I connect directly to my modem I recieve speeds of 80-90 MBps down and 5MBps up. When I go through my router speeds drop to between 15-25 MBps and 4-4.5 MBps up. Is it possible that my router is just faulty in some way? a gigabit router should not be affecting network speeds this severely...

    Should I hasten my process of building myself a high-performance router and just get rid of my current one?

  4. Absolutely love the idea. Sounds like a show/segment I could really get into and enjoy watching.

    I do agree that there are some potential drawbacks here. I feel that if the computers to be "hacked" were on a VPN it would allow for more privacy of the participants. However, the best option would be to bring contestants in and have the participate on a private and offline VPN.

  5. Too directly answer your question. No you did not say "Yes" to the yes man. It seems someone may be attempting something on your network. I would suggest blocking the MAC, should keep him off you (until he changes his MAC anyway).

  6. QOS is enabled. The only special Rule is for a mine craft server I run, I will try disabling this rule while keeping the QOS engine itself running.

    I have been playing with it. It seems to have no effect on speeds.

  7. I am streaming the videos to my computer, such as you tube, netflix etc. There is very little upload going on here.

    Edit: The D-Link was purchased last November. So it is less than one year old.

  8. Currently I have amazingly fast internet (100Mbps down and 5mbps up). I can download files, play games and surf the internet, all at the same time, with no problems at all! But when it comes to streaming video... something goes wrong. When streaming videos I cannot go over 480p or I have to wait for 20 seconds of buffering every 5 seconds or so. I have tried disabling all other traffic and only allowing Fire Fox internet access, to see where the bottleneck is. I ended up getting the same speeds, regardless of what kind of traffic was going through my network. The PC I tested this on is running an Intel core i7 950 on a Saber-tooth X58 with 12GB ram, more than capable of streaming a 720p+ video and storing the Data. I have modified some files within Fire Fox such as the max pipe-lining and some others (the basics really).

    I don't believe this issue is client side, so I am at a loss as to where to look now. I am using a D-link router. While it is a higher(ish) end model (for the consumer world), I know my issue could be lying with it.

    Does anyone know an immediate (even short term) fix for this? I will soon be building a router myself, but I am unsure as to how to solve my streaming issues for the time being.

    Edit: I should also add that I have tested streaming quality on my laptop as well as my room mates laptop (wired and wireless). Each and every time my results are the same. My router currently contains no rules as to packet priority, so there should be no discrimination in which packets get through.

  9. I'll have to look into that digininja. I'm especially interested in the VPN side of it, for a few reasons. One is to reroute traffic to through ssh (for when I;m on public WiFi) and the other would be to remotely access my home PC from anywhere. I'm just glad there are people out there who develop the tools to accomplish these things. It is just up to learn how to use them and implement them properly.=P

  10. Might have to look into that. I will probably include a WiFi card in my server/router/firewall box to reduce size. It seems like running an external gigabit switch is going to be my best option here, from what you have been telling me (and the prices of the NIC's). If you don't mind me asking, what are the direct benefits of using a business oriented switch? I'm sure they are more reliable and faster than consumer level products, but are there any other direct benefits?

    Now I just need to decide on LED colors. Do I want Green, Red, Blue, White? or something else? lol

    On the side of caching, I have a spare 60GB OCZ Vertex 2 kicking around from my main PC build. I upgraded from it to a 240GB OCZ Agility 3. Sadly I didn't notice windows was auto defragging it... so it only lasted a year and a half :/ Got it replaced with a Muchkin 240GB, so I'm happy :)

    When it comes to web caching, is 60GB enough? I am not the most familiar with it. My network load on average would probably consist of around 500-1000 web pages per day, 50-100 streaming videos. I also host 2 game servers, 1 VPN (actually private), 3-4 game clients and a fair amount of torrents. While most of the latter don't rely on caching, my network bandwidth is usually near full. So what I want to be sure of is that sufficient information can be cached so I can still access the internet readily as needed.

    Currently I am using my main PC as a bit of a server box and I feel it is time to move some load off of it and onto a real box. So my first step is to set up a quality network! Correct me if I'm wrong here, but I see this as the best way to move forward.

  11. Yes I have noticed that the network cards are expensive as hell. Perhaps a regular gigabit switch will be fine in this situation. I would then use the router box as more of a WiFi adapter, cache point and anything else really. I have a lot of thinking to do.

    Do you know of any high quality gigabit ethernet switches? All I ever seem to find are the D-link and Cysco ones (in retail stores anyway)... probably not my best bet here as I want something that can actually handle large stress loads.

    Thank you for the insight digininja.

  12. To give a little bit more information this is going to be a router that is connected to the outside world, so the more security I can script into it the better (this is why I want a Linux distro).

    @Infiltrator

    I noticed that Smooth-wall recently went closed-source. Is this going to be a major concern for me or will I still be able to add scripts/plugins if needed?

    On a side note, reliable routers are hard to come by. All of the ones I have purchased seem to have issues streaming videos (a cache problem I am assuming?) I am hoping a custom router can help me solve this issue. Also, they just look cool!

    I plan on setting up some kind of network mass storage as well, this is where the need for a gigabit adapter comes in. I don't think I am willing to go with a fiber connection (I don't think I can justify the cost as those seem to run for over $1000).

    Maybe I'm in over my head here, but I want a router that will be able to handle the demands I throw at it, while still being able to efficiently access the internet.

    @digip

    New price is less than refurbished and used? This seems like it might be a "hot" buy to me, but who am I to say it isn't legit. Thank you for the post :) I will have to check out amazon/eBay a bit more I think. Most retailers are crazy expensive! store bought routers have 4 port gigabit switches and the basic models sell for $40. I never thought this to be such an issue! lol

    Thank you for the information guys. Keep up your great work :)

  13. @digip

    Love the response here. There is a great YouTube video of a gentlemen by the name of Schuyler Towne. It is a video of a demonstration he gave at Defcon on the vulnerabilities of locks of all types. He opened, or explained how to open, just about every type of lock there is (that someone would find in their daily lives). I highly suggest looking it up if anyone here is interested, very informative.

  14. Is this anything like gathering session tokens? This seems like a bit more work as it requires that the cookie be decrypted before it can be used.

    Correct me if I'm off here, but I just feel like this has already been done before.

  15. I've been looking into making myself a custom made router (similar to the one Darren made). I have been looking at the various distributions that are available and I seem to be liking Smooth-wall (ironically enough it is what Darren himself suggested in the episode where he makes his router). Is Smooth-wall still one of the best router OS distributions to use? Or is there a better distribution that I should be looking into? Also, I have been looking into parts I am thinking about going with an Asus board (micro ATX) with LGA 1155 so I cna use second gen core i series processors (probably an i3). I want to add a few hard drives (most likely SSD) for caching and I figured the processor speed could be useful for divvying out tasks while maintaining network speeds. The hardest thing for me to find now seems to be a four port gigabit lan adapter that runs 802.3az or newer. Does anyone know where I can find a decent network adapter like this for under $400 (as this is what all of the 4 port cards I've seen run)?

    Also, if anyone has experience in making a router, do you have any suggestions for hardware/software.

    All advice is appreciated :)

    Thanks guys!

  16. You might also want to have a look at EMET from Mircosoft, it is supposed to stop certain exploits from occurring: http://blogs.technet...ng-emet-v3.aspx

    There is a side effect though, it is claimed that some programs do not work with this technology because they need the behaviour that the tool blocks to function correctly.

    I do not have experience with this tool so if you use it perhaps let us know in a separate thread?

    Yes because what this program does is limit several services such as Secondary Login. Secondary login is essential to many programs now including Diablo 3. You can turn off many unessential services from within the computer management section and clicking on services

  17. Time to Upgrade, Im on R2 gnome 64 right now so probably going to upgrade to R3 gnome 64. How much moar space dose the new release need?? I'm installing on an SSD

    The BT5R3-GNOME-64 ISO is: 3.07 GB (3,306,489,856 bytes)

  18. lol spybot. too chatty for my likes. I suppose if one had the time to research every change that a program might need to make. For instance, today I ran rosetta stone for the first time in some time, and my seurity software quarentined it because it wanted to add a site to trusted sites, and make some other changes. I allowed it, then reserched the ip it was reaching to... rosettastone website. So the attempt was likely legitamate, and i learned a little something, but I would prefer not to deal with it every time i install a program.

    Personally I prefer MSE as an AV, MBAM as AntiMalware,ThreatFire as anomoly bsed HIPS and rootkit checker. eventually when I get home, i'll tr some patch management, IDS, and so on. :)

    Spybot too chatty? It keeps you safe. If a program is not notifying you of potential suspicious activity, then why would it be worth having? I do agree that when I am using a legitimate program and I receive a warning when the program tries to access a legitimate site/service, it is rather annoying. Simply stated, of all the reasons I would stop using windows, having to allow a program through the firewall each and every time isn't one of the reasons. Much the same can be said for Spybot, although, I'm not going to stop using it. :)

×
×
  • Create New...