relay must try again an hour later. If you notice the time, you get a hint of what is to come. The "victim" of the denial–of-service attack here is not a victim at all, it is a mail server and it is down. The mail is queued up all over the world trying to send it the mail. Every hour these systems, all over the world, try again, often near the top of the hour. So, we have this false SYN flood condition.

Another very common false positive is Microsoft Internet Explorer visiting a web page. It creates a connection for each GIF, JPEG, HTML, and so forth, up to a limit of 32. As a rule of thumb, therefore, do not report a SYN flood on TCP 25, TCP 80, or TCP 443.

Even better, as a general rule, be very slow to believe your IDS or to report a SYN flood (especially because you are just beginning your journey as an analyst). Most commercial intrusion-detection systems produce false positives on SYN floods so often that you have to set their counters to a very high number, which means they will never detect a real SYN flood. The good news is that more modern operating systems can resist SYN floods of low numbers of SYNs, so it is becoming safer and safer to ignore them. The SYN floods that do affect modern systems are very high volume and difficult not to detect.

Although SYN floods in low volumes might be safe to ignore, the Windows Trojan horses (such as Back Orifice) certainly are not. These programs can give an attacker total control over an infected computer. When dealing with a high-risk problem such as Back Orifice, the analyst should not turn that filter off on the intrusion-detection system even if the filter generates false

positives.

Back Orifice?

Trojan horses and scanning for Trojans accounts for a large number of the attacks between mid1997 and the present. Back Orifice and Netbus were the original frontrunners in late 1998 or early 1999, and then SubSeven became a major force in late '99 and early 2000. The default port for Back Orifice is 31337 UDP, and 12345 TCP for Netbus (port 12346 as well, although I have never seen this in actual use). Most Trojans can be configured to operate at other ports of course, which can make it harder to locate them. Further, 31337, like 666 and the hex patterns dead beef are often of hacker activity. We saw this following trace twice in a single day; I just

had to chuckle:

11:20:44.148361 ns1.com.31337 > ns2.arpa.net.53: 38787 A? arb.arpa.net. (34) 11:52:49.779731 ns1.com.31337 > ns1.arpa.net.53: 39230 ANY? hq.arpa.net. (36)

This is a great time to mention that TCPdump has a desire to be helpful. Although this is a UDP trace, it does not say UDP like the first echo example of this chapter. Instead, TCPdump uses this opportunity to tell us more about the packet because it knows DNS (UDP port 53), because DNS has its own format. Our client system ns1.com is doing a name lookup on the DNS server ns*.arpa.net. So what are the 31337s doing there?

As an analyst, this was the question I wanted to answer when I saw the trace. We pulled the packet, printed it in hex, ran it through tcpshow, and compared it to other DNS lookups. It was normal.

Before BIND 8, the expected, although not required, behavior from a name server doing a UDP lookup is that the source port is 53 as well. Sometimes, I have seen the source port as 137, indicating that the client is a Windows system. Why 31337?

Like all of us, I was busy at work, so I forgot about it until an analyst at another site flagged the same pattern to my attention. I picked up the phone and started working my way through this corporation until I finally found the bright young chap who managed the DNS server. I told him what I saw:

Northcutt: I am seeing source port 31337s coming to various DNS servers. Young Chap: Uh, we've looked into it, and it is not Back Orifice.

Northcutt: I know that, but it sets off every intrusion-detection system that sees it. Young Chap: You should fix your intrusion-detection system.

Northcutt: No. You fix your source port or my site will block you, and my friend's sites will block you; your company will lose its contracts, and you will lose your job.

He asked who I was again, and we started to make progress toward a solution.