Someone spoofing me

[octopus]

I'm glad I have my Hammer-ips script.

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination       
20553 1233K logdrop    all  --  any    any     anywhere             anywhere             match-set Hammer-ips src

Dec  3 13:42:46 kernel: DROPIN=vlan11 OUT= MAC=e0:3f:49:ee:0c:e0:00:08:ae:8d:f5:80:08:00:45:30:00:3c SRC=193.111.9.219 DST=xx.xx.xx.xxx LEN=60 TOS=0x10 PREC=0x20 TTL=48 ID=1178 DF PROTO=TCP SPT=49748 DPT=123 SEQ=2953521117 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 OPT (020405B40402080A065123470000000001030307)

 

[nova]

what is this showing and doing?

 

[sfx2000]

perhaps go a bit more into detail?

 

[octopus]

Oh sorry but 20553 hits from IP 193.111.9.219 in a couple of hour.

 

[sfx2000]

ok, I'm still lost here - is this someone from the Ukraine scanning your external host?

 

[sfx2000]

And if you want - just block the entire ASN there perhaps...

193.111.9.0/24

% Abuse contact for '193.111.8.0 - 193.111.9.255' is 'info@united.net.ua'

inetnum:        193.111.8.0 - 193.111.9.255
netname:        UN-UKRAINE
org:            ORG-UNU1-RIPE
country:        UA
admin-c:        UNU-RIPE
tech-c:         UNU-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-by:         UN-UKRAINE-MNT
mnt-routes:     UN-UKRAINE-MNT
created:        2002-03-04T14:49:00Z
last-modified:  2016-04-14T08:10:02Z
source:         RIPE
sponsoring-org: ORG-IC26-RIPE

organisation:   ORG-UNU1-RIPE
org-name:       United Networks of Ukraine, Ltd
org-type:       OTHER
address:        Ukraine, Kyiv, Leontovicha 9 str.
abuse-c:        AC29896-RIPE
mnt-ref:        UN-UKRAINE-MNT
mnt-by:         UN-UKRAINE-MNT
created:        2012-01-19T16:20:03Z
last-modified:  2016-02-15T16:45:22Z
source:         RIPE # Filtered

role:           United's Systems Network Coordination Center
address:        Leyptsigskaya, 6
address:        Kiev, Ukraine
phone:          +380 44 2542233
fax-no:         +380 44 2545692
abuse-mailbox:  abuse@united.net.ua
admin-c:        SN444-RIPE
tech-c:         GTN-RIPE
nic-hdl:        UNU-RIPE
mnt-by:         UN-UKRAINE-MNT
created:        2002-10-01T15:16:34Z
last-modified:  2016-02-03T10:41:41Z
source:         RIPE # Filtered