호스팅 TIP
보안
시스템
프로그래밍
네트워크
|
시스템보안
|
DDOS
이용안내
|
호스팅 TIP
|
자유게시판
|
회원가입

월간 인기 게시물

게시물 160건
   
아이피 변조 트래픽 유출
글쓴이 : 최고관리자 날짜 : 2014-11-13 (목) 15:11 조회 : 3898
글주소 :
                          

증상 
가상화내 HOST에서 특정1개의 VM에서 1개의 MAC주소에서 랜덤한 소스 아이피로 외부로 트래픽 유출

조치 
MAC 주소를 기반으로 VM 확인

# tcpdump -nnei virt4XX7E -c 100
15:07:52.262964 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.151.28450 > 112.124.2.113.30571: Flags [S], seq 1864547709:1864548605, win 65535, length 896
15:07:52.263061 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.22.13.55882 > 112.124.2.113.30571: Flags [S], seq 3662348102:3662348998, win 65535, length 896
15:07:52.263158 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.200.30849 > 112.124.2.113.30571: Flags [S], seq 2021769232:2021770128, win 65535, length 896
15:07:52.263253 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.39.29982 > 112.124.2.113.30571: Flags [S], seq 1964964907:1964965803, win 65535, length 896
15:07:52.263369 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.22.71.44014 > 112.124.2.113.30571: Flags [S], seq 2884555125:2884556021, win 65535, length 896
15:07:52.263476 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.161.53154 > 112.124.2.113.30571: Flags [S], seq 3483514368:3483515264, win 65535, length 896
15:07:52.263573 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.63.5318 > 112.124.2.113.30571: Flags [S], seq 348561435:348562331, win 65535, length 896
15:07:52.263667 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.189.7775 > 112.124.2.113.30571: Flags [S], seq 509544037:509544933, win 65535, length 896
15:07:52.263761 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.73.15199 > 112.124.2.113.30571: Flags [S], seq 996142190:996143086, win 65535, length 896
15:07:52.263855 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.209.57452 > 112.124.2.113.30571: Flags [S], seq 3765184586:3765185482, win 65535, length 896
15:07:52.263951 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.110.42137 > 112.124.2.113.30571: Flags [S], seq 2761513748:2761514644, win 65535, length 896
15:07:52.264051 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.66.45234 > 112.124.2.113.30571: Flags [S], seq 2964502109:2964503005, win 65535, length 896
15:07:52.264146 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.22.29.30254 > 112.124.2.113.30571: Flags [S], seq 1982745703:1982746599, win 65535, length 896
15:07:52.264242 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.22.47.12365 > 112.124.2.113.30571: Flags [S], seq 810361091:810361987, win 65535, length 896
15:07:52.264363 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.0.57449 > 112.124.2.113.30571: Flags [S], seq 3765020748:3765021644, win 65535, length 896
15:07:52.264468 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.21.44650 > 112.124.2.113.30571: Flags [S], seq 2926201384:2926202280, win 65535, length 896
15:07:52.264566 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.113.187 > 112.124.2.113.30571: Flags [S], seq 12266546:12267442, win 65535, length 896
15:07:52.264661 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.19.61719 > 112.124.2.113.30571: Flags [S], seq 4044865147:4044866043, win 65535, length 896
15:07:52.264754 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.89.30735 > 112.124.2.113.30571: Flags [S], seq 2014252357:2014253253, win 65535, length 896
15:07:52.264849 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.22.38.60169 > 112.124.2.113.30571: Flags [S], seq 3943299872:3943300768, win 65535, length 896
15:07:52.264945 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.196.38384 > 112.124.2.113.30571: Flags [S], seq 2515596649:2515597545, win 65535, length 896
15:07:52.265040 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.201.36043 > 112.124.2.113.30571: Flags [S], seq 2362135878:2362136774, win 65535, length 896
15:07:52.265134 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.116.4715 > 112.124.2.113.30571: Flags [S], seq 309032208:309033104, win 65535, length 896
15:07:52.265231 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.64.10250 > 112.124.2.113.30571: Flags [S], seq 671789657:671790553, win 65535, length 896
15:07:52.265341 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.127.21869 > 112.124.2.113.30571: Flags [S], seq 1433242659:1433243555, win 65535, length 896
15:07:52.265446 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.134.29079 > 112.124.2.113.30571: Flags [S], seq 1905767742:1905768638, win 65535, length 896
15:07:52.265541 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.174.6161 > 112.124.2.113.30571: Flags [S], seq 403815176:403816072, win 65535, length 896
15:07:52.265636 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.237.23659 > 112.124.2.113.30571: Flags [S], seq 1550569745:1550570641, win 65535, length 896
15:07:52.265731 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.143.55715 > 112.124.2.113.30571: Flags [S], seq 3651356526:3651357422, win 65535, length 896
15:07:52.265846 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.152.7039 > 112.124.2.113.30571: Flags [S], seq 461336439:461337335, win 65535, length 896
15:07:52.265942 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.209.53476 > 112.124.2.113.30571: Flags [S], seq 3504603457:3504604353, win 65535, length 896
15:07:52.266038 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.211.37237 > 112.124.2.113.30571: Flags [S], seq 2440378973:2440379869, win 65535, length 896
15:07:52.266132 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.132.36228 > 112.124.2.113.30571: Flags [S], seq 2374266470:2374267366, win 65535, length 896
15:07:52.266226 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.56.37425 > 112.124.2.113.30571: Flags [S], seq 2452690544:2452691440, win 65535, length 896
15:07:52.266329 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.22.22.5657 > 112.124.2.113.30571: Flags [S], seq 370777931:370778827, win 65535, length 896
15:07:52.266435 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.20.101.63602 > 112.124.2.113.30571: Flags [S], seq 4168255573:4168256469, win 65535, length 896
15:07:52.266530 de:ad:be:e4:XX:7e > 70:72:cf:3c:XX:e0, ethertype IPv4 (0x0800), length 950: 115.XX.21.18.14116 > 112.124.2.113.30571: Flags [S], seq 925132831:925133727, win 65535, length 896

이름 패스워드
비밀글 (체크하면 글쓴이만 내용을 확인할 수 있습니다.)
왼쪽의 글자를 입력하세요.
   

 



 
사이트명 : 모지리네 | 대표 : 이경현 | 개인커뮤니티 : 랭키닷컴 운영체제(OS) | 경기도 성남시 분당구 | 전자우편 : mojily골뱅이chonnom.com
| 이용약관 | 개인정보취급방침 | 책임의한계와 법적고지 | 이메일무단수집거부 | 이용안내
Copyright ⓒ www.chonnom.com www.kyunghyun.net www.mojily.net. All rights reserved.