RE: ARP "Who has (one address)" > "Tell (many different, random IP's)"

Just thinking out loud here...

Wouldn't this behavior (multiple hosts all doing lookups for a single IP
address) be an indication that there was some service running on that
one host?  Have you checked the IP address that everyone's looking up to
see if they're running a web/p2p/music/whatever server?

Jon

-----Original Message-----
From: snort-sigs-admin@xxxxxxxxxxxxxxxxxxxxx
[mailto:snort-sigs-admin@xxxxxxxxxxxxxxxxxxxxx] On Behalf Of Matt
Kettler
Sent: Thursday, October 28, 2004 11:45 AM
To: yawles@xxxxxxxxxx; snort-sigs@xxxxxxxxxxxxxxxxxxxxx
Cc: Adam Forsyth; Jeff Williams
Subject: Re: [Snort-sigs] ARP "Who has (one address)" > "Tell (many
different, random IP's)"

At 09:09 AM 10/28/2004, Les Yaw wrote:
>We're a "residential college" with over 2,700 college students with 
>their own computers on our "ResNet."  We seem to be under attack from 
>within.  My Senior Sys Admin looked on the firewall's tcpdump activity 
>shows massive quantities of ARP traffic, which ask "Who has (one single

>internal IP address)" with a destination of "Tell (multiple, random 
>internal IP addresses)."
>We're with the belief this is the activity of a slew of zombie 
>computers on our network.
>
>Has anyone ever seen such activity?
>Can you tell us what the name of this trojan/worm/viruii is?

It would be impossible from that alone to tell if there was a trojan,
worm or virus at work, much less which one.

Normaly a worm like slammer is going to have the oposite relationship.
One host will be asking lots of who has questions for a variety of
hosts.

         i: ARP who has (multiple random internal IPs) tell (one single
internal IP)


Is the one single internal IP address one of your gateways or servers?
If 
so, that's entirely normal. All the hosts in your network are going to
have 
to arp for it. Windows machines will re-arp about once every 5 minutes,
so 
this gets to be a lot of arps on a large network.

Really your best action for that is creating different subnets (even if 
only on VLANs using a managed routing switch) to control the scope of 
broadcasts to a hundred machines or so at a time.





-------------------------------------------------------
This Newsletter Sponsored by: Macrovision 
For reliable Linux application installations, use the industry's leading
setup authoring tool, InstallShield X. Learn more and evaluate 
today. http://clk.atdmt.com/MSI/go/ins0030000001msi/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/snort-sigs





-------------------------------------------------------
This Newsletter Sponsored by: Macrovision
For reliable Linux application installations, use the industry's leading
setup authoring tool, InstallShield X. Learn more and evaluate
today. http://clk.atdmt.com/MSI/go/ins0030000001msi/direct/01/