The bottom line, as I see it, is that probably no one is attacking Wanz’ firewall. Just some “false-positives”, you have lot of them on any firewall / IDS, however low sensitivity you set. At least all the time you will have some late responce packets, which will miss the period during which a firewall is keeping there connection open and waiting…

BR,

Petko

I don’t see why using port 39341 means that an address-translation session is initiated. I’d rather suppose an address translation in the second line:

TCP Packet – Source:210.7.0.36,3473 Destination:210.7.12.23,135 – [DOS]

where some private IP from one subnet is routed through a NATting device to a second subnet in the same organization, and because port 135 is a “well-known hacking port”, whatever it means, the firewall is stopping the packet.

Well, if these records are caught on the internal interface of the firewall, then there is a second explanation – somebody took a laptop with a static primary network configuration (144.120.8.89) into the LAN with private range IPs – but then nameserver and gateway settings should not work. Or the third one (really a more probable variant of the 2nd) – they have a “mixture” of private and public IPs on the same LAN, private using NAT and public using routing – pretty bad idea, but happens. In this case they should re-configure the firewall to allow these connections and not to complain about them.

BR,

Petko

I’d be mostly worried about the first hit:

TCP Packet – Source:144.120.8.89,39341 Destination:192.168.1.1,25 – [DOS]

You should never get on your outer interface packets to private destination 192.168.1.1, unless there is misconfigured router in your nearest proximity, that means yours or your ISP router… Considering the second and third hits, I will agree with Celtic – they are probably not a problem at all.

Good luck,

Petko

Easy to do if the ip addresses are all static, harder to do if they are dynamic addresses. If they are dynamic, then providing the time they are valid is more than a few days, you could interigate the dhcp router for their mac addresses, and watch the traffic for a few days to see if there is a pattern.

I have to agree with celtic, it doesn’t necessarily mean a dos attack, it could simple be an acl rule that is blocking the traffic as celtic suggested.

If it is bothering you, you should investigate further. The time spent won’t be wasted as it will give you a more in-depth view of you internal network.

Dave