Suspicious Packet with MAC address all zeros

[sum0831]

Hi All,

I monitor networks for my client, recently I discovered some suspicious outbound traffic from internal to a known malicious host, although the packet was dropped on the PA. the logs I have showing that the packet's source IP as the internet's router sub interfaces IP with MAC address all zeros & destination IP as the malicious host and destination MAC all zeros.

After a chat with one of the network guys, he advised someone might be spoofing an IP from the internal, sicne the setup is internal ->PA->internet router->internet. and the packet was dropped before it reached the router.

My questions are, what does the MAC address with all zeros tells me? and are there any way of figuring out the "true" source of the traffic? since there could be a compromised host in the network?

Thanks

[reaper]

all-zeroes mac might indeed be a spoofing attack from someone (or something) smart enough to hide the hardware address

the next place you should look is the network switch to see if you can determine the switchport the mac address is known on, you  might be able to zero your search

on a cisco switch that would be something like

show mac address-table address 0000.0000.0000

the output, with a little luck, could tell you the port the mac was seen on:

PANW_CORE#sh mac address-table 
Codes: * - primary entry

  vlan   mac address     type    learn qos            ports
------+----------------+--------+-----+---+--------------------------
*    1  0090.0b22.7d8c   dynamic  Yes   --  Gi4/2
*    3  001b.175d.1310   dynamic  Yes   --  Gi3/7

[sum0831]

we ran a packet capturing and manage to get some logs off the PA, we have identified the MAC address of the outbound traffic was actually from one of the interface of the router to the malicious host. but I still can't identified the internal host that generated this traffic. Please advise.

The malicious host inbound traffic were on TFTP some sort of Read request to some pdf documents. and the outbound traffic was UDP with No such file in the data.

[sum0831]

I personally think it is a TFTP DDoS, based on this article.

https://securityintelligence.com/news/trivial-file-transfer-protocol-used-in-new-ddos-attack/