Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite

I see the following pattern in every 2-3 sec, for several minutes in syslog:

Shorewall:net2fw:DROP:IN=eth0 OUT= MAC=aa:bb:cc:dd:ee:ff:gg:hh:ii:jj:kk:ll:mm:nn SRC=12.34.56.78 DST=98.76.54.32 LEN=60 TOS=0x00 PREC=0x00 TTL=41 ID=12746 DF PROTO=TCP SPT=41611 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0

where values at ID and SPT are different in each line.The server is Debian 6.0, with shorewall and fail2ban.

How can I narrow down what is going on and use fail2ban and shorewall to better block this?

share|improve this question
Looks like tcpdump output, but what the reason of this message i don't know. – Renat Zaripov Dec 19 '12 at 9:37
2  
That's a connection attempt to port 22 (DPT= destination port, SYN = connection establishment attempt) on your machine (SSH). – Mat Dec 19 '12 at 12:28

1 Answer

up vote 1 down vote

My solution ended up at this Fail2ban filter:

failregex = DROP:IN=eth0 OUT= MAC=[a-zA-F0-9:]+ SRC=<HOST> DST=([0-9]{1,3}\.?){4} LEN=
            DROP:IN=eth0 OUT=vmbr0 SRC=<HOST> DST=([0-9]{1,3}\.?){4} LEN=

added to /etc/fail2ban/filter.d/sshd-ddos.conf

It bans these requests on ssh port.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.