topic Re: Suspicious Packet with MAC address all zeros in General Topics

Suspicious Packet with MAC address all zeros

sum0831 — Tue, 16 May 2017 22:54:51 GMT

Hi All,

I monitor networks for my client, recently I discovered some suspicious outbound traffic from internal to a known malicious host, although the packet was dropped on the PA. the logs I have showing that the packet's source IP as the internet's router sub interfaces IP with MAC address all zeros & destination IP as the malicious host and destination MAC all zeros.

After a chat with one of the network guys, he advised someone might be spoofing an IP from the internal, sicne the setup is internal ->PA->internet router->internet. and the packet was dropped before it reached the router.

My questions are, what does the MAC address with all zeros tells me? and are there any way of figuring out the "true" source of the traffic? since there could be a compromised host in the network?

Thanks

Re: Suspicious Packet with MAC address all zeros

reaper — Wed, 17 May 2017 08:20:45 GMT

all-zeroes mac might indeed be a spoofing attack from someone (or something) smart enough to hide the hardware address

the next place you should look is the network switch to see if you can determine the switchport the mac address is known on, you might be able to zero your search

on a cisco switch that would be something like

show mac address-table address 0000.0000.0000

the output, with a little luck, could tell you the port the mac was seen on:

PANW_CORE#sh mac address-table 
Codes: * - primary entry

  vlan   mac address     type    learn qos            ports
------+----------------+--------+-----+---+--------------------------
*    1  0090.0b22.7d8c   dynamic  Yes   --  Gi4/2
*    3  001b.175d.1310   dynamic  Yes   --  Gi3/7

Re: Suspicious Packet with MAC address all zeros

sum0831 — Thu, 18 May 2017 02:39:39 GMT

we ran a packet capturing and manage to get some logs off the PA, we have identified the MAC address of the outbound traffic was actually from one of the interface of the router to the malicious host. but I still can't identified the internal host that generated this traffic. Please advise.

The malicious host inbound traffic were on TFTP some sort of Read request to some pdf documents. and the outbound traffic was UDP with No such file in the data.

Re: Suspicious Packet with MAC address all zeros

sum0831 — Thu, 18 May 2017 03:03:16 GMT

I personally think it is a TFTP DDoS, based on this article.

https://securityintelligence.com/news/trivial-file-transfer-protocol-used-in-new-ddos-attack/