Merhaba arkadaşlar. Dün akşam itibari ile sistemimde kasmalar meydana geliyordu. Şuan tcpdump -nn komutuyla belli IP'lerime nameserverlar üzerinden spoof geldiğini farkettim. Çıktıyı sizinle paylaşıyorum. Bu saldırıyı engelleyebilmek için hangi legleri kapatmam gerekiyor yada önerebileceğiniz nedir yardımlarınızı rica ediyorum.



15:36:29.528939 IP xxxxxxxxxxxxxxxxxxxx > 67.19.47.170: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 556
15:36:29.528944 IP 67.227.182.211.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 Refused- 0/0/1 (36)
15:36:29.528947 IP xxxxxxxxxxxxxxxxxxxx > 67.227.182.211: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 72
15:36:29.528959 IP 74.122.120.111.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 ServFail 0/0/1 (36)
15:36:29.528963 IP 184.72.46.185.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 Refused- 0/0/1 (36)
15:36:29.528966 IP xxxxxxxxxxxxxxxxxxxx > 184.72.46.185: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 72
15:36:29.528970 IP 50.97.103.27.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 Refused- 0/0/1 (36)
15:36:29.528974 IP xxxxxxxxxxxxxxxxxxxx > 50.97.103.27: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 72
15:36:29.528977 IP 84.53.99.226.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 12/4/13 SPF, DNSKEY, DNSKEY, NAPTR, TXT "v=spf1 a mx ip4:204.152.184.0/21 ip4:149.20.0.0/16 ip6:2001:04F8::0/32 ip6:2001:500:60::65/128 ~all", TXT "$Id: isc.org,v 1.1893 2014-04-26 03:29:30 dmahoney Exp $", MX mx.ams1.isc.org. 10, MX mx.pao1.isc.org. 10, NS sfba.sns-pb.isc.org., NS ord.sns-pb.isc.org., NS ams.sns-pb.isc.org., NS ns.isc.afilias-nst.info. (1267)
15:36:29.528982 IP xxxxxxxxxxxxxxxxxxxx > 84.53.99.226: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 556
15:36:29.529083 IP 88.198.1.250.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809- 0/13/14 (659)
15:36:29.529089 IP xxxxxxxxxxxxxxxxxxxx > 88.198.1.250: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 556
15:36:29.529094 IP 88.198.7.217.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 Refused- 0/0/1 (36)
15:36:29.529097 IP xxxxxxxxxxxxxxxxxxxx > 88.198.7.217: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 72
15:36:29.529101 IP 178.63.68.36.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809- 0/1/2 (83)
15:36:29.529117 IP xxxxxxxxxxxxxxxxxxxx > 178.63.68.36: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 119
15:36:29.529121 IP 216.246.98.49.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 ServFail- 0/0/1 (36)
15:36:29.529125 IP xxxxxxxxxxxxxxxxxxxx > 216.246.98.49: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 72
15:36:29.529128 IP 216.86.147.77.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 ServFail- 0/0/1 (36)
15:36:29.529131 IP xxxxxxxxxxxxxxxxxxxx > 216.86.147.77: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 72
15:36:29.529135 IP 178.251.197.66.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809- 0/13/14 (659)
15:36:29.529139 IP xxxxxxxxxxxxxxxxxxxx > 178.251.197.66: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 556
15:36:29.529202 IP 96.127.136.52.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809 Refused- 0/0/1 (36)
15:36:29.529222 IP xxxxxxxxxxxxxxxxxxxx > 96.127.136.52: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 72
15:36:29.529226 IP 109.203.121.149.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809- 0/13/14 (659)
15:36:29.529230 IP xxxxxxxxxxxxxxxxxxxx > 109.203.121.149: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 556
15:36:29.529234 IP 96.31.93.213.53 > xxxxxxxxxxxxxxxxxxxx.25345: 10809- 0/13/14 (659)
15:36:29.529238 IP xxxxxxxxxxxxxxxxxxxx > 96.31.93.213: ICMP xxxxxxxxxxxxxxxxxxxx udp port 25345 unreachable, length 556





Not : XXXXXXX yazan yerler makinamın olduğu IP'yi temsil etmektedir.

Teşekkürler.