Centroid.EU Blog

(this blog is mostly encrypted - adults only)

Previous Page

A week of synfloods

August 24th, 2019

Since about the 16th I've noticed a subtle synflood emanating from up to 160 /24's on mostly cloud providers. For the last day or so this has gone down to a trickle and I assume it's only testing the water or so.

I learned a lot about netfilter and pf this week. For one in pf when you do a os fingerprinting there is no statistics in a pfctl -srules -vv on fingerprinted packets. Finally I applied the synproxy rules on my openbsd servers with:

pass in quick on em0 proto tcp from any to $kite_ip port { 53 }  synproxy state

On Linux the story is a bit different. At first I applied the hosts that were synflooding me with a small script, such as this:


netstat -na | awk '/SYN_REC/ {print $5}' | awk -F: '{a = split($1, b, "."); prin
tf("%s.%s.%s.0/24\n", b[1], b[2], b[3]); }' | sort -u |\
        while read i; do
                iptables -L -v -n | awk '{ print $8 }' | grep -q $i
                if [ $? -eq 1 ]; then
                        iptables -A SYNNERS --proto tcp -s $i  --dport 53 -j DRO
                        iptables -A SYNNERS --proto tcp -s $i  --dport 80 -j DRO
                        iptables -A SYNNERS --proto tcp -s $i  --dport 443 -j DR

exit 0
But that can only go so far, then I analysed the SYNflood packets closer, immediately I realized that the window size was 29200 bytes. This is the window size of some Linux'es. But they differ in that this synflood did not apply any options (making it a 1st generation exploit), making it easy to filter. I have made another script to install the filters:
iptables -F INPUT
iptables -F NORMALIP
iptables -A INPUT --proto tcp --dport 53 -m u32 --u32 "0&0x0f000000>>24=5" -j NO
iptables -A NORMALIP --proto tcp --dport 53 -m u32 --u32 "0&0x000000ff=0x28 && 3
2&0x0000ffff=0x7210" -j DROP
iptables -A INPUT --proto tcp --dport 53 --j SYNNERS
What the first u32 rule does is it finds "normal" IPv4 headers that don't have options, (and are thus) of 20 bytes length. This allows it to traverse into the NORMALIP table where IP length of 40 bytes is checked and the window size of 29200 bytes. For most Linux'es that use a win size of 29200 bytes this is ok because they add the TCP MSS option on SYN when connecting, thus increasing their IP length beyond 40 bytes.

While this was a great way to spend time with colleagues and friends on IRC (because they had synfloods as well), I got little delphinusdnsd programming done this week (which I had originally planned). Oh well.. maybe next week!

As far as the synflooder it's hard to know what it is. I suspect it's a worm that uses spectre to break into other cloud hosts and then installs a syn- flooder. But it's only a guess.


EuroBSDCon 2019 in Lillehammer, Norway

August 18th, 2019

In almost exactly one month is Eurobsdcon in beautiful Norway. Unfortunately I won't be going. But I recommend anyone who thinks they are somewhat good with the BSD's to go meet the people that frequent BSDCon's. A lot can still be learned, and getting together in Norway makes a nice setting.


Ice Polar caps an endangered thing

August 18th, 2019

Slashdot turned off it's anonymous coward posting so I'm posting this here. Elon wake up! Polar caps endangered.


RIP MrBill

August 16th, 2019

The news has reached me that mrbill died. Sad. 1990's Efnet IRC is where we all sat and chatted. Best of times! You can compare now with then and back then everyone was just ok. I'm sure someone has logs of those days, but it was one thing to read logs and another to have a socket connected and view things in real time.


Laniakea and the great attractor

August 13th, 2019

In conversation on IRC today I likened the universe like a prairie grass. Going back to youtube I then re-found this good clip (youtube.com) 4 min. Enjoy.


Besides delphinusdnsd, secondary projects

August 12th, 2019

One problem with life is that there is not enough time to persue all things that one wants to do. Here is my list of secondary projects that I have started or would like to do other than delphinusdnsd:

  • powerpc64 port, porting OpenBSD to the PowerMAC G5 64-bit
  • kismet_drone doesn't work on my 841Nv10 access point I'd like to write a compatible clone to kismet_drone
  • I'd like to write a fetchmail clone that does some things better
These are the things I'm doing on the side or hoping/thinking of doing.


I produce roughly 5.8 Tonnes of CO2 per year

August 11th, 2019

Not counting the food I eat, I produce about 5.8 Tonnes of CO2 per year with 11,000 KWh's (estimated) for heating, cooling and electricity. This is calculated via this CO2 calculator. I compared this with my parents who rent a house and drive a car and it's a lot less than their CO2 output.


In my opinion there is a conflict of interest regarding NATO

August 9th, 2019

In the Sueddeutsche Zeitung (german, sz.de) the USA threatens with a re-deployment of german american troops to Poland. This can only be welcomed in Germany I think, since it is Germanys intention to have no foreign troops on its soil. Sure there will be jobs lost and the economy is gonna take a slight hit, but other than that NATO troops in Germany are superfluent. NATO itself will likely die in the next 20 years since we'll get the European Army most likely. My reasoning to this is that Ursula von der Leyen already said that she wants to arm the EU with an army. This is supported by Macron and Merkel. So while the european corps are being built up, there is a COI regarding NATO. NATO itself is irrelevant by now. What is its mission? Surely not to keep Mr. Mao from China out of Europe in Afghanistan. Afghanistan may be a pivot to cut China off, but it also encloses the core islamic world. I may have said it before, but muslim countries are surrounded by european forces (Mali, Africa to Afghanistan, to mainland Europe). Why this is exactly I'm not even sure of.


I'm crying for the human

August 7th, 2019

Stop abusing land, scientists warn (BBC.com). Look at the average 20th century temp!


The Frankfurt train pusher

August 2nd, 2019

Difficult situation. What happened here is a few days ago a supposedly psycho man from switzerland (with roots from Eritrea, Africa) pushed an 8 year old and his mother off the platform as the train was pulling in. The kid did not survive it. That this man was african is not a warning to me. That he was psycho had to do with his background (horrible living conditions in war-torn Eritrea), but I can attest that having lived in Frankfurt during a psychosis that the train station there is an intimidating place.

I have a memory of waiting for a train in Frankfurt and someone parked a utility waggon with blinkers right in my field of view and turned the warning blinkers on. There wasn't a reason to do this and it really annoyed me in the state of mind I was in. I don't think I was taking medication anymore due to running out back then, and the psychiatrist I had in Frankfurt was not a good psychiatrist, I fell out of the security netting there so to speak.

To describe the train station in Frankfurt to you. It's a dead end train station and trains that move in to a platform have to go out backwards. You enter from the "front" of the station and walk down the platforms to your train section. Before you enter the platforms there is kiosks that sell things, and there is always a bunch of men standing against the wall of these kiosks. They're always there.

In my psychosis I called these people the secret police, because they weren't pick-pockets or else they would have been dispersed but they were surely loitering if they weren't the police. Funny how I remember it in that way. Another annoying thing in the train station there is when announcements are made as it echos through the entire building and it gives merit to the german saying "ich versteh nur Bahnhof" meaning "I only understand train-station" meaning I don't understand what they just said.

For people subjected to stress and particularily psychos like me it is a very energy robbing time to be taking the train. Stress levels reach a maximum I'd say whenever I take the train to a larger place like Frankfurt. Unfortunately the train-pusher also was stressed out and I'm sure he didn't want the kid to die. Also it's impossible to know what was said. If they insulted him in some way then that would have been a factor for the murder. I'm not defending him or his illness but I think you have about a 50/50 chance of bettering a situation in train stations when you have more police presence.

I've seen Ordnungsamt (these aren't really cops they are ticketers for law and order) staff give tickets to a young man because he had an insult written on his jacket. That was a few levels below the train station in the S-Bahn rapid transit platform. The guys jacket said something like "you're all assholes" or something like that and that caused him to be ticketed with being insulting to the public. All in all Frankfurt is an insane place and if you want to escape the insanity you drive into it per car and avoid the public. That's what the rich bankers do. Not very economic or green for todays climate though.


Next Page


RSS Feed

Click here for RSS

On this day in

Other links

Have feedback?

By clicking on the header of an article you will be served a cookie. If you do not agree to this do not click on the header. Thanks!

Using a text-based webbrowser?

... such as lynx? Welcome back it's working again for the time being.

Older Blog Entries

Powered by BCHS