I've been DoS attacked....from inside my LAN!!

[newbie~wan]

I was watching survivor. I come back and try to load a web page. Nothing happens. I look in my systray and see the Sygate icon flashing. I open it up. This is what it says:

Security Type: Denial of Service
Severity : Major
Direction: Outgoing
Protocol: ICMP
Remote Host: 192.168.1.102
Local IP: 192.168.1.101
Application involved:

Denial of Service "IP Fragmentation Overlap" attack detected.
Description:
An IP Fragmentation Overlap attack exploits IP's packet reassembly feature by creating packet fragments with overlapping offset fields, making it impossible for your system to reassemble the packets properly.

Anyone know what to make of this? Whatever it was, it apparently stopped.

[vass0922]

Who is Remote Host: 192.168.1.102 ??

Whos' on that IP?

Is it your router by chance?
If so it could of indeed come from outside, but since it was routed through it appears to be from inside.

If its from a PC, maybe there is a zombie installed.
Check for viruses!!!
Make sure there is a firewall on that PC as well!!

If that IP does not exist on your LAN hmmm no clue

[DVNT1]

Could be someone using tools like TFN, TFN2K, or Trinoo. It may be a SMURF attack in which the source IPs are spoofed.


What is your LAN enviroment? Like number of PCs, just yours or other peoples, using a NAT router, etc...

[vass0922]

oh yeah spoofing... duh lol

Could be a bad case of backdoor trojans too

[FreakyOCR]

Hey do you have a router?? I get that when Sandra(I think) tries a network benchmarkk..

[newbie~wan]

192.168.1.102 is in my LAN. All my computers sit behind a router w/ NAT. That box currently doesnt have a firewall on it, but mine does (192.168.1.101).

I think Freaky nailed it. I performed a Sandra total analysis. The time that Sygate reports the attack would have been about the same time I ran Sandra. However, a warning did pop up shortly after I began the test asking if I wanted to allow Sandra access to the network, so I told it yes. I then left the box and didnt come back for an hour.

I suppose its possible that sandra asked for access again and I wasnt there to Ok it this time. I'll run it again when I get home tonight and see if I get the same message.