Can somebody make sense out of this?

[Guest]

[balthazor]

hey all of a sudden i started getting these alerts, i read the other thread on an invalid flag combination but i didn't understand. screenshot below.

thanks

[Zito]

I don't think it's anything to be alarmed about. The log is merely informing you that the TCP flag combination "ACK FIN RST" is invalid. Broken down to its individual components, "ACK" means "Acknowledge", "FIN" means "Finished" i.e. no more data from the sender, and "RST" means "Reset the connection". My interpretation of it would be that your PC can't send an acknowledgement because the sender (with IP 82.152.188.253) has already reset the connection.

The IP address resolves to host81-152-188-253.range81-152.btcentralplus.com which is part of "BT Central Plus:  Operational Support". If that's your ISP, there's nothing to worry about.

Details concerning "Protocol Analysis" can be found in the Tasks --> Advanced Attack Detection etc., --> Miscellaneous menu.

[balthazor]

Well i'm not with BT internet as far as i am aware. does that mean somebody else is trying to reset my internet connection or something? and i dont live in manchester either

[grue155]

In that other topic about the invalid flag combination, the situation looks like it is probably malware trying to gain access to a CFP protected machine. However, that does not mean that what you are seeing in your log is the same thing. It could be just a badly configured fileshare client.

So let me ask a couple of questions to see if what you're seeing is related to that other topic.

Do you have a NAT/router? Do you run any filesharing software? If you do, is it bitcomet?

The CFP detail you gave showed a destination address of 192.168.0.3 and port 1880. I'd like for you to run "netstat -an" from an command prompt, and post the result. This will list what ports your machine is using a that moment.

[balthazor]

i have a router, yes. i have bittorrent installed on my computer but it's been closed for a few days. and when i run netstat -an, it closes straight after it finishes?

[grue155]

Strange that netstat just closes. So lets try a different method. From sysinternals.com, download a network utility program "tcpview". Sysinternals.com was acquired by Microsoft earlier this year, so you'll get a redirect to a Microsoft site.

Tcpview will monitor your network connections as they're happening. You're looking for something unexpected. There may be a fileshare process running around in the background, and what you're seeing are remote clients trying to connect to that background process. If that is the case, then it'll show in the network connections.

Regarding your router, is it a Linksys router, or a different brand? And what model router?

[balthazor]

and Netgear WGT624?

[grue155]

Thank you. You have a very different router than that in the other topic. So your router isn't something that is any kind of concern.

Now the tcpview, change one of the top line toolbar Options, and unselect "Resolve Addresses". The plain IP address is enough, as some domain names can be quite long. The detail that needs to be seen, is the port number, and that is the trailing :number in the connections list.

What we're trying to match up, is the port number in the CFP log to something that is running at that moment. If there is no fileshare client running on your machine, and something that we think might be a fileshare packet trying to come in, then something unexpected is going on. You're going to have to watch the traffic, and watch the CFP log, and see what matches and what doesn't. Tcpview can pin itself to the top of your desktop, so it is easy to watch.

Tcpview can save it's information to a text file which you can post here, if that is more convenient than using a screenshot.

[balthazor]

How do I change the top toolbar?

[grue155]

Now the tcpview, change one of the top line toolbar Options, and unselect "Resolve Addresses". The plain IP address is enough, as some domain names can be quite long. The detail that needs to be seen, is the port number, and that is the trailing :number in the connections list.

Sorry, confusing wording on my part. Open Tcpview. On the top line that says "File Options Process View Help", select Options, and then select "Resolve Addresses" to clear the checkmark. Selecting will toggle the checkmark back and forth.

 

[Tags:]