Newsgroup: it.comp.reti.cisco
Titolo: log access-list : traffico udp anomalo sulla 137 di reti contigue. W32 Opaserv.worm ?

Salve a tutti,
Prima di postare ho letto le FAQ e mi rendo conto che  forse non e' neppure
il gruppo adatto per fare questa domanda  ... pero' vi illustro lo stesso il
mio problema , non si sa mai che qualcuno possa averlo gia' affrontato e
risolto :)
Sul centrostella ( CISCO 2611 ma non e' rilevante ) di una intranet ho
implementato in ingresso su tutti i dialer/tunnel dalle reti periferiche (
CISCO 8XX  ma anche qui non e' rilevante) un access-list per consentire solo
un certo tipo di traffico loggando tutto il traffico anomalo.
Ecco un piccolo estratto (ma significativo ) del log  :
Mar  6 20:55:02 192.168.192.5 3527596: Mar  6 19:54:46: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.46.215(137), 1
packet
Mar  6 20:55:02 192.168.192.5 3527597: Mar  6 19:54:47: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.46.222(137), 1
packet
Mar  6 20:55:03 192.168.192.5 3527599: Mar  6 19:54:48: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.46.229(137), 1
packet
Mar  6 20:55:04 192.168.192.5 3527603: Mar  6 19:54:50: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.46.236(137), 1
packet
Mar  6 20:55:05 192.168.192.5 3527604: Mar  6 19:54:51: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.46.243(137), 1
packet
Mar  6 20:55:07 192.168.192.5 3527611: Mar  6 19:54:52: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.46.250(137), 1
packet
Mar  6 20:55:08 192.168.192.5 3527617: Mar  6 19:54:53: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.1(137), 1 packet
Mar  6 20:55:10 192.168.192.5 3527621: Mar  6 19:54:54: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.8(137), 1 packet
Mar  6 20:55:11 192.168.192.5 3527624: Mar  6 19:54:55: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.15(137), 1
packet
Mar  6 20:55:11 192.168.192.5 3527627: Mar  6 19:54:56: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.22(137), 1
packet
Mar  6 20:55:13 192.168.192.5 3527633: Mar  6 19:54:57: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.29(137), 1
packet
Mar  6 20:55:15 192.168.192.5 3527638: Mar  6 19:54:58: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.36(137), 1
packet
Mar  6 20:55:16 192.168.192.5 3527642: Mar  6 19:54:59: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.43(137), 1
packet
Mar  6 20:55:16 192.168.192.5 3527643: Mar  6 19:55:00: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.50(137), 1
packet
Mar  6 20:55:16 192.168.192.5 3527644: Mar  6 19:55:01: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.57(137), 1
packet
Mar  6 20:55:18 192.168.192.5 3527649: Mar  6 19:55:02: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.64(137), 1
packet
Mar  6 20:55:19 192.168.192.5 3527652: Mar  6 19:55:03: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.71(137), 1
packet
Mar  6 20:55:20 192.168.192.5 3527656: Mar  6 19:55:04: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.78(137), 1
packet
Mar  6 20:55:21 192.168.192.5 3527660: Mar  6 19:55:05: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.85(137), 1
packet
Mar  6 20:55:22 192.168.192.5 3527663: Mar  6 19:55:06: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.92(137), 1
packet
Mar  6 20:55:23 192.168.192.5 3527666: Mar  6 19:55:07: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.99(137), 1
packet
Mar  6 20:55:25 192.168.192.5 3527674: Mar  6 19:55:08: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.1(137), 1 packet
Mar  6 20:55:26 192.168.192.5 3527678: Mar  6 19:55:09: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.23(137), 1
packet
Mar  6 20:55:26 192.168.192.5 3527680: Mar  6 19:55:11: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.30(137), 1
packet
Mar  6 20:55:28 192.168.192.5 3527685: Mar  6 19:55:12: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.37(137), 1
packet
Mar  6 20:55:29 192.168.192.5 3527687: Mar  6 19:55:13: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.44(137), 1
packet
Mar  6 20:55:30 192.168.192.5 3527691: Mar  6 19:55:14: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.51(137), 1
packet
Mar  6 20:55:31 192.168.192.5 3527694: Mar  6 19:55:15: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.58(137), 1
packet
Mar  6 20:55:31 192.168.192.5 3527695: Mar  6 19:55:16: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.65(137), 1
packet
Mar  6 20:55:32 192.168.192.5 3527699: Mar  6 19:55:17: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.45.169(1026) -> 192.168.44.162(137), 1
packet
Mar  6 20:55:34 192.168.192.5 3527706: Mar  6 19:55:18: %SEC-6-IPACCESSLOGP:
list firewall denied udp 192.168.83.101(1029) -> 192.168.84.78(137), 1
packet
Appare evidente che tutto il traffico e' generato dai client (win xx) verso
la porta udp 137 (netbios) della rete contigua.come se fosse uno portscan.
In estrema sintesi :
192.168.n.pc (10xy)->192.168.(n +/- 1).* (137)
sto cercando di capire se possa W32/Opaserv.worm che ha infettato tutta la
intranet
o se possa essere un servizio particolare Microsoft che da questo tipo si
problemi ?
------------------
Remote Infection
Significant NetBIOS traffic (UDP) is caused by this worm. One of the
early indications of this worms activity was the increase in port 137
hits on firewalls. This traffic is caused by the worm issuing WINS
queries across contiguous IP ranges. The spreading mechanism observed in
testing is outlined below:
the worm issues WINS query (to retrieve NetBIOS name).
the worm then tries to establish a NetBIOS session to the remote
machine. if successful the worm attempts to spread via connecting to
\\%machinename%\C using SMB (Server Message Block) commands (ie.
requiring open 'C' share on remote machine). This worm can infect
password-protected shares if the security patch is not installed.
Please Note: if this patch is installed, but the share is not password
protected, the worm will still spread to the machine.
[..]
The worm attempts to spread to all machines on the local subnet in the
above manner, (working through the subnet increasing the last octet of
the IP address for each WINS query).
Subsequently, in testing the worm was observed to follow the above
mechanism for machines in the IP range A.B.(C+1).0 to A.B.(C+1).255
(where A.B.C.x is the local subnet).
Following that, the mechanism was repeated continually, with an
apparently random starting IP address (for example 16.13.145.5 ->
16.13.145.255). Once the final octet is incremented to 255, a new
initial starting IP is queried.
http://vil.mcafee.com/dispVirus.asp?virus_k=99729
.
---------------------
Qualcuno ha gia' avuto esperienze in merito ?
E' lui o ci sono probabilita'  che possa essere qualche applicativo windows
che genera tutto quel traffico esagerato ?
Grazie comunque per l'attenzione .
Cordialita'
M.

 che genera tutto quel traffico esagerato ?
Sia l'una che l'altra... ;-)