I've identified a particular IPv4 /24 subnet that is responsible for a great deal of the unsolicited packets being rejected by my router (and making my log files larger than I'd like them to be). As a traffic mitigation technique - or if I just wanted to "send a message" to the originating servers, has it ever been done or even considered (or possible given your average business-class router) to forward or redirect these packets back to their source IP (or a single selected IP that you know is part of the /subnet where these packets are coming from) ?

I've searched the web for various ways to ask this question and haven't found any example where this question was pondered or better yet put into practice.

  • 5
    It's been considered over the years and is generally a terrible idea. You have no idea whether the source of the offending traffic is actually the source and, frankly, the various carriers (and their customers) between you and your target are also paying the price. It's the Internet. If it's that objectionable then block the range - or, better still, have your upstream block them. This assumes you've gone through the usual channels of abuse aliases and NOC contacts. What you're suggesting is essentially half of a DoS. – rnxrx Oct 10 '20 at 1:21
  • 5
    You have no way to know that the traffic is actually coming from the network you think it is, only what is listed as the source address in the possibly forged IP headers. First, even if the source network is correct, you will not actually bother the bots that are sending the traffic. Next, if the source on the traffic is forged, you will then end up bothering some other innocent. Either way, you have not accomplished your objective. – Ron Maupin Oct 10 '20 at 5:55
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 17 '20 at 22:40

Trying to use some kind of retaliation is a bad idea. The source IP address you see may be spoofed, or some kind of amplification attack may be used. It is also quite possible that the attacker notices your attempts and intensifies the attack - very often, they've got significant resources, so beware. Retaliating likely solves no problem and causes new ones.

Instead, silently drop the traffic as soon as possible. The usual way is to use an inbound ACL to filter the traffic, based on source address range, protocol, ... That way, the attacker might simply go away.

If the attack traffic binds serious resources on your side, contact your ISP and ask them for help. They can filter the traffic on their inbound link already.

Additionally, you might want to investigate the owner of said IP address/range (whois) and send them a complaint (abuse@ and hostmaster@ are used for this). Make sure you describe the problem in a short and precise way and include relevant logging (example, approximate number of events, time period). Respectable ISPs usually do react in some way.

  • The /24 in question is owned by IP Volume. These are TCP packets, and are clearly port scans. So clearly these ARE the source, and are not being spoofed. If these were spoofed then I wouldn't consistently see these hits from the same /24. Port scans to find open ports don't work if the source IP is being spoofed. My router (all routers) drop unsolicited packets so it's not about how to block or drop them, my main beef is the space they're using up in my log files. – Peggy Schafer Oct 10 '20 at 12:33
  • Its my understanding that doing nothing (ie having no particular rules for dealing with unsolicited packets) is probably the "best" passive way to deal with this because routers will simply drop unsolicited packets and the source IP gets nothing back - no indication there is anything on my end listening. Am I correct about this? – Peggy Schafer Oct 10 '20 at 12:37
  • 1
    It's not only common to see those port scans but it's the rule. If you don't see them you're not looking. If I see these kinds of scans - repeatedly from the same subnet/addresses in rather high frequency for an extended time - I deliberately filter those source subnets/addresses, without logging. – Zac67 Oct 10 '20 at 13:13
  • 1
    Then don’t log or filter your logs before analyzing them. Retribution doesn’t magically keep your logs clean. If you don’t want traffic from IP Volume, consider null routing that /24. – Teun Vink Oct 10 '20 at 13:56
  • > If you don’t want traffic from IP Volume, consider null routing that /24< Does that take more router overhead than having no rule and dropping the packet? Regarding this crap coming from IP Volume - it started in July and has been happening daily. Some days the interval is on average 2 minutes, other days its 7 seconds. Overall that's about 280,000 log lines over 75 days. – Peggy Schafer Oct 10 '20 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.