FIN Scan attack

shplink

unread,

Oct 17, 2009, 8:44:04 PM10/17/09

to

Hello,

I have a 12-year old who is using a Linux Ubuntu box. While on YouTube,
my netgear router reports

[DOS attack: FIN Scan] attack packets in last 20 sec from ip
[74.125.155.167], Saturday, Oct 17,2009 18:06:35

That IP number (and variations .165, ,164, etc) appear to belong to
Google / YouTube.

The Ubuntu box has Guarddog on it, FWIW; nothing significant seems to be
happening. I wonder if any of you have run into anything similar. A
search engine indicates that they are probably simple browser requests
that my router misinterprets.

Any ideas?

Thanks!

--
shplink
http://shplink.com/misc/FAQ.htm

siljaline

unread,

Oct 17, 2009, 10:33:39 PM10/17/09

to

The one IP resolves to:
<quote>
OrgName: Google Inc.
OrgID: GOGL
Address: 1600 Amphitheatre Parkway
City: Mountain View
StateProv: CA
PostalCode: 94043
Country: US

NetRange: 74.125.0.0 - 74.125.255.255
CIDR: 74.125.0.0/16
NetName: GOOGLE
NetHandle: NET-74-125-0-0-1
Parent: NET-74-0-0-0-0
NetType: Direct Allocation
</quote>

I would imagine the remaining IP's are within the same NetRange listed above.
Your son's Ubutntu is being pinged by Google.

HTH

Silj

--
"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_

shplink

unread,

Oct 17, 2009, 11:01:31 PM10/17/09

to

siljaline wrote:
> shplink wrote:
>> Hello,
>>
>> I have a 12-year old who is using a Linux Ubuntu box. While on YouTube,
>> my netgear router reports
>>
>> [DOS attack: FIN Scan] attack packets in last 20 sec from ip
>> [74.125.155.167], Saturday, Oct 17,2009 18:06:35
>

SNIP

>> Thanks!

>>
> The one IP resolves to:
> <quote>
> OrgName: Google Inc.
> OrgID: GOGL
> Address: 1600 Amphitheatre Parkway
> City: Mountain View
> StateProv: CA
> PostalCode: 94043
> Country: US
>
> NetRange: 74.125.0.0 - 74.125.255.255
> CIDR: 74.125.0.0/16
> NetName: GOOGLE
> NetHandle: NET-74-125-0-0-1
> Parent: NET-74-0-0-0-0
> NetType: Direct Allocation
> </quote>
>
> I would imagine the remaining IP's are within the same NetRange listed above.
> Your son's Ubutntu is being pinged by Google.
>
> HTH
>
> Silj
>

Thanks, Siljaline:
I noticed those IPs belong to Google... I kinda wonder *why* they are
trying to ping her. Assuming it's not a spoofed-number thing (highly
doubt it), what is this "service" trying to determine?

John Mason Jr

unread,

Oct 18, 2009, 12:35:55 PM10/18/09

to

Can you get a packet capture of the traffic between the ISP and the netgear?

John

shplink

unread,

Oct 18, 2009, 3:39:07 PM10/18/09

to

Thank you, John: Good idea. I have Ethernal (OS X's flavor of Ethereal)
on my mac, and can install Ethereal on the Ubuntu box in question
-although I think I can monitor the traffic from my mac....

I am not very well practiced in its use, and timing will be important,
but I'll try it out. I am really curious about why and what they're probing.

Great tip!

John Mason Jr

unread,

Oct 18, 2009, 8:19:52 PM10/18/09

to

If you can update to Wireshark there have been a number of improvements
and bug fixes from the ethereal code.

John

shplink

unread,

Oct 18, 2009, 9:20:55 PM10/18/09

to

Whoa- Wireshark. Nice app! This is fun!
;-)

shplink

unread,

Oct 18, 2009, 10:21:45 PM10/18/09

to

Damn it. She's been on YouTube all day, and the attacks have stopped. I
*did* install Privoxy, I am not sure I can see how, but could *that*
have deterred?