TCP Flags: SYN-ACK-URG TCP Header Corrupt

[intehnet]

All,

SmartDefense picked up this packet sent into my network. destination was an entire subnet (sent to x.x.x.0), on a TCP high port, with the TCP flags SYN-ACK-URG.
I can't work out if this was a malformed packet or some sort of exploit I haven't heard of before.
IIRC, windows 95 blew chunks when it was sent URG when in a certain state?

It's not urgent obviously, but just curious..

[srikrishnak]

The Urgent Pointer is used when some information has to reach the server ASAP. When the TCP/IP stack at the other end sees a packet using the Urgent Pointer, it is duty bound to stop all it's doing and immediately send this packet to the relevant server. Since the packet is plucked out of the processing queue and acted upon immediately, it is known as an Out Of Band (OOB) packet and the data is called Out Of Band (OOB) data. The Urgent Pointer is usually used in Telnet, where an immediate response (e.g. the echoing of characters) is desirable.
May be FW-1 sees it as some attack ;)

[intehnet]

thanks, it's a corrupt header, just happens to have URG in it.
Sounds dodgey to me, it's coming from one IP to an entire subnet.

[srikrishnak]

Happens some times..whatever the reason may be..weather an application error or a program issue..Even a BAD NIC card could be the culprit.

[wancom]

I see this same behavior from 61.133.3.47 to a couple of our networks. The traffic is always to a.b.c.0. This has been going on for over a week now. I cant find any mention of an exploit - or any advisories - however that source address is being reported pretty frequently at dshield.org

[intehnet]

wancom, that's the same IP i'm getting the traffic from!!

how odd!

[flawless_cowboy]

oddly enough, i see the same thing from the same IP.

[intehnet]

it has a webserver open, in chinese i think..

[rcarlin]

I'm picking up the same thing here on our network. The source has been constant from 61.133.3.47. WHOIS shows that to be a Chinese newspaper network. I noticed it today and found that it started on the 19th.

The source port appears to be 80/tcp with random destination ports. The rate is also 1-3 per hour.

[intehnet]

i've blocked this IP from my network, even though it's packets were being dropped anyway.