[Intrusions] Odd Protocol Type Conversation
Jason Tant
ingress976 at gmail.com
Fri Dec 10 15:43:51 GMT 2004
Good day,
Recently, I began seeing the below flows between several machines on
one of my client's networks. Machine A (73:30:50) appears to be
attempting to request bootstrapping through Cisco switch B (09:AC:B0)
to a DHCP server C (51:50:0B). My questions are: If these are valid
request, then why is the protocol type in frames 1 & 2 0xffff? Why is
there data in the last portion of both packets 1 & 2? And why does my
domain name appear in the end of the return packet (packet 2)?
0000 00 90 27 51 50 0b 00 50 73 09 ac b0 ff ff 00 00 ..'QP..P s.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 70 ........ .......p
00d0 f0 b4 92 70 f0 b4 d0 f0 b0 b4 70 f0 f0 34 d8 f0 ...p.... ..p..4..
00e0 b0 b4 f0 f0 f0 94 f4 f0 70 30 e0 f0 f0 f0 f8 f0 ........ p0......
00f0 f4 30 f0 f0 d0 b0 f0 e0 f0 f0 d0 b0 d0 f0 f0 f0 .0...... ........
0100 f0 f4 f0 b0 90 fc f0 b0 f0 f4 70 f0 f0 b0 ........ ..p...
-------------------------------------------------------------------------------------------------------------
0000 00 50 73 09 ac b0 00 90 27 51 50 0b ff ff 00 00 .Ps..... 'QP.....
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00b0 00 63 82 53 63 35 01 05 3a 04 00 00 a8 c0 3b 04 .c.Sc5.. :.....;.
00c0 00 01 27 50 33 04 00 01 51 80 36 04 c0 a8 0a 0a ..'P3... Q.6.....
00d0 01 04 ff ff ff 00 0f 10 XX XX XX XX XX XX XX XX ........ mydomain
00e0 XX XX XX XX XX XX XX 00 03 04 c0 a8 0a 01 2c 08 dot.com. ......,.
00f0 c0 a8 0a 0a c0 a8 0a 06 2e 01 08 06 10 c0 a8 0a ........ ........
0100 06 c0 a8 0a c0 8a b4 be 78 8a b4 be 79 ff ........ x...y.
-------------------------------------------------------------------------------------------------------------
0000 00 90 27 51 50 0b 00 50 73 09 ac b0 08 00 45 00 ..'QP..P s.....E.
0010 01 48 6a b3 00 00 ff 11 ba 87 c0 a8 0a 0f c0 a8 .Hj..... ........
0020 0a 0a 00 43 00 43 01 34 25 13 01 01 06 01 00 00 ...C.C.4 %.......
0030 07 e2 d8 2b 00 00 00 00 00 00 00 00 00 00 00 00 ...+.... ........
0040 00 00 c0 a8 0a 0f 00 60 fd 73 30 50 f0 f0 f0 e0 .......` .s0P....
0050 f0 d0 d0 f2 f0 b8 00 00 00 00 00 00 00 00 00 00 ........ ........
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0110 00 00 00 00 00 00 b0 fd d0 f0 fc f0 f8 7d b2 fc ........ .....}..
0120 f0 f2 f0 f0 f2 f8 f0 f8 f0 f8 f2 fc f4 fc f0 f0 ........ ........
0130 f8 7c f0 f0 f0 fc fc f6 f0 fc f0 f0 f8 f0 f0 f8 .|...... ........
0140 f0 b0 f0 f8 f8 f8 f0 b0 f0 f4 f5 f6 f8 f0 f0 f1 ........ ........
0150 f1 f2 f0 f0 f1 f4 ......
---------------------------------------------------------------------------------------------------------------
Any insight appreciated.
Jason
More information about the Intrusions
mailing list