Bad loopback traffic not stopped by ipfw.

[Tony Frank]

Hi all,

On Wed, Feb 25, 2004 at 05:21:34PM +0300, Gleb Smirnoff wrote:
> On Wed, Feb 25, 2004 at 04:19:51PM +0200, Iasen Kostov wrote:
> I> >>16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > 
> I> >>192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0
> I> >
> I> >This is some kind of Win32 virus. This floods can be easily
> I> >stopped by ipfw rule:
> I> >
> I> >deny tcp from any to any tcpflags rst,ack
> I> >
> I>    These packets never reach IPFW as we can see.
> 
> Ughu. Really.
> But I have millions of them from non-localhost addresses.
> 

This maybe is of interest?

http://www.dshield.org/pipermail/list/2004-January/014027.php

Regards,

Tony