Newsgroup: it.comp.sicurezza.unix
Titolo: Firewall Unix/Posix - Ancora Microsoft ci prova con IP Fragment !!??

Salve, spero che questa mia esperienza possa essere utile
al n.g.
Il giorno 10-10-2001  alle 17:59 sono andato sul sito
Microsoft
riservato ai rivenditori (212.97.39.168) e sul sito
 
https://oem.microsoft.com/worldwide/501924.asp
sempre riservato agli operatori del settore, e ......
ma chissà come mai mi sono ritrovato nel mio IDS
una serie di pacchetti frammentati provenienti da
207.46.197.101
AAAAAAAH proprio da Microsoft !!!
.?..che la Microsoft voglia "vedere" qualcosa in maniera
poco lecita?????
Se qualche volenteroso mi sa dare delle spiegazioni
già da ora lo ringrazio.
Alessio Sommariva
smmgpp...@tin.it
--
Piu' passano gli anni piu' m' accorgo che
l'arte dello imparare e lo vizio
del sapere son spirito giovine.
Alessio

Oops scordavo la prova.....
Eccola, Vedere/provare per credere
[**] Tiny Fragments - Possible Hostile Activity
[**]/10-10:17:59.615560 207.46.197.101 -> xx.mio.ip.xxTTL:49
TOS:0x0 ID:38797 IpLen:20 DgmLen:44 MFOffset: 0x0   Frag
Size: 0x1850 09 D2 A5 02 AF 1D 1B A6 E7 61 80 10 3E E0
.P.........a..>.A F0 00 00 01 01 08
........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible Hostile
Activity [**]/10-10:17:59.663648 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:38798 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 B4 C5 1B A6 E7
61 80 10 3E E0  .P.........a..>.2B 00 00 01 01 08
0A.+......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:18:00.097383 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:38983 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 BA 6D 1B A6 E7
61 80 10 3E E0  .P.....m...a..>.41 00 00 01 01 08
   )A......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
+=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:18:00.146480 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:38984 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 C0 15 1B A6 E7
61 80 10 3E E0  .P.........a..>.AA 00 00 01 01 08
0A........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:18:00.195526 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:39030 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 C5 BD 1B A6 E7
61 80 10 3E E0  .P.........a..>.86 00 00 01 01 08 0A
7.......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible Hostile
Activity [**]/10-10:18:00.243558 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:39031 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 CB 65 1B A6 E7
61 80 10 3E E0  .P.....e...a..>.E C0 00 00 01 01 08
0A........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:18:03.083758 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:40647 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 D4 FD 1B A6 E9
AD 80 10 3C 94  .P............<.59 00 00 01 01 08
0A.Y......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:18:03.165711 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:40648 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 DA A5 1B A6 E9
AD 80 10 3C 94  .P............<.F CC 00 00 01 01 08
0A........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:18:06.890733 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:42702 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 F0 EC 1B A6 EF
6C 80 10 3C 93  .P.........l..<.EB 00 00 01 01 08
0A........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:18:06.952327 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:42703 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 F6 94 1B A6 EF
6C 80 10 3C 93  .P.........l..<.D1 00 00 01 01 08 0A
E.......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible Hostile
Activity [**]/10-10:18:07.000966 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:42704 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 02 FC 3C 1B A6 EF
6C 80 10 3C 93  .P.....<...l..<.3A 00 00 01 01 08 0A
.:......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible Hostile
Activity [**]/10-10:18:20.977189 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:49894 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 03 22 1B A6 F0
89 80 10 3B 76  .P....."......;v2E 00 00 01 01 08
0A........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:18:21.039137 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:49895 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 08 CA 1B A6 F0
89 80 10 3B 76  .P............;v0E 00 00 01 01 08 0A
3.......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible Hostile
Activity [**]/10-10:18:21.087250 207.46.197.101 ->
xx.mio.ip.xxTTL:49 TOS:0x0 ID:49896 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 0E 72 1B A6 F0
89 80 10 3B 76  .P.....r......;v77 00 00 01 01 08
0A.w......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:19:44.105695 207.46.197.101 ->
xx.mio.ip.xxTTL:47 TOS:0x0 ID:32346 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 15 58 1B A6 F1
A6 80 10 3A 59  .P.....X......:YB6 00 00 01 01 08
........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible Hostile
Activity [**]/10-10:19:44.167270 207.46.197.101 ->
xx.mio.ip.xxTTL:47 TOS:0x0 ID:32347 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 1B 00 1B A6 F1
A6 80 10 3A 59  .P............:YD 99 00 00 01 01 08
0A........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:19:44.215479 207.46.197.101 ->
xx.mio.ip.xxTTL:47 TOS:0x0 ID:32348 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 20 A8 1B A6 F1
A6 80 10 3A 59  .P.... .......:Y02 00 00 01 01 08
0A........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:20:44.652943 207.46.197.101 ->
xx.mio.ip.xxTTL:47 TOS:0x0 ID:802 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 27 8E 1B A6 F2
B8 80 10 40 00  .P....'.......@.6A 00 00 01 01 08 0A
xj......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible Hostile
Activity [**]/10-10:20:44.714020 207.46.197.101 ->
xx.mio.ip.xxTTL:47 TOS:0x0 ID:803 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 2D 36 1B A6 F2
B8 80 10 40 00  .P....-6......@.4D 00 00 01 01 08
0A.M......=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+[**] Tiny Fragments - Possible
Hostile Activity [**]/10-10:20:44.762651 207.46.197.101 ->
xx.mio.ip.xxTTL:47 TOS:0x0 ID:804 IpLen:20 DgmLen:44
MFOffset: 0x0   Frag Size: 0x1850 09 D2 A5 03 32 DE 1B A6 F2
B8 80 10 40 00  .P....2.......@.B6 00 00 01 01 08
0A........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+=+=+=+=+=+=+=+=+
Alessio Sommariva
smmgpp...@tin.it