Comcast packet spoofing

[madopal]

Ok, so check this one out.  I started at a new job this week.  They use Comcast & a cable modem for their connection.  As I've mentioned before, I run my own box.  So, this morning, I'm ssh'ed in, when I notice that I can't get to my webmail.  Seems strange, but I figure maybe it's my server.  I IM a few people, and everyone can hit my web server just fine.  They can hit everything else just fine.

Me, however, different story.  Mail, web, even a new SSH connection: nopers.  Nada.  Everything just times out.

So, I fire up Wireshark and see what's happening.  Well, well...I'm getting reset packets.  Now, I have to see if I can run a command line version of Wireshark on the other end, but it looks like *all* traffic to my IP is being blocked by Comcast with their reset mode.  Now, I'm not running P2P thru them.  The only thing I can figure is that either a) by ssh'ing I triggered something, or b) they're trolling for P2P packets, because I've been sharing Fedora since it launched last month.

Any thoughts on other ways to prove that they're in fact blocking by IP as opposed to just certain traffic?

[Defcon 5]

When I went to college from what I recall they blocked IP addresses, mostly because I was connecting to banned sites using the IP addresses, they watched over me too much!
How about trying to setup a dyndns address and trying to access through that?

[madopal]

Ok, I got 'em.  Here's me trying to do a simple wget from my server at work, and what I see on a packet sniffer on both ends.  On my work machine, I see 4 requests, then a reset, then my requests start retrying.

On my server, I only see the requests.  I'm sending responses that never get to my work computer..  Here are the packets going back and forth...to port 80, mind you.  Now, I'm using Wireshark at work (gui) and snort at home (console), so that is why the formatting is different.  But you can see not only the ID's, but the ports & sizes match when they hook up.

You can also see...the request gets through, my server sends a response which never arrives.  Then, after a few more tries and a pause, a mysterious reset packet shows up.  For completeness, a packet is shown after.

Code:

work:
388	
2007-12-06 15:30:50.050948	
YYY.YYY.YYY.YYY	XXX.XXX.XXX.XXX	
TCP	33028 > http [SYN] Seq=0 Len=0 MSS=1460 TSV=97922341 TSER=0 WS=6

server:
12/06-15:30:50.062572 0:D:72:1E:10:F9 -> 0:1:3:69:44:AF type:0x800 len:0x4A
YYY.YYY.YYY.YYY:33028 -> XXX.XXX.XXX.XXX:80 TCP TTL:53 TOS:0x0 ID:23969 IpLen:20 DgmLen:60 DF
******S* Seq: 0xF7467084  Ack: 0x0  Win: 0x16D0  TcpLen: 40
TCP Options (5) => MSS: 1452 SackOK TS: 97922341 0 NOP WS: 6

12/06-15:30:50.062600 0:1:3:69:44:AF -> 0:D:72:1E:10:F9 type:0x800 len:0x4A
XXX.XXX.XXX.XXX:80 -> YYY.YYY.YYY.YYY:33028 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:60 DF
***A**S* Seq: 0xE32982FD  Ack: 0xF7467085  Win: 0x16A0  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 4071114589 97922341 NOP
TCP Options => WS: 7

work:
no such packet

------------

work:
900	
2007-12-06 15:31:20.044749	
XXX.XXX.XXX.XXX	YYY.YYY.YYY.YYY	
TCP	http > 33028 [RST] Seq=0 Len=0

home server:
no such packet

------------

work:
1131	
2007-12-06 15:31:35.050804	
YYY.YYY.YYY.YYY	XXX.XXX.XXX.XXX	
TCP	33028 > http [SYN] Seq=0 Len=0 MSS=1460 TSV=97967341 TSER=0 WS=6

home server:
12/06-15:31:35.060509 0:D:72:1E:10:F9 -> 0:1:3:69:44:AF type:0x800 len:0x4A
YYY.YYY.YYY.YYY:33028 -> XXX.XXX.XXX.XXX:80 TCP TTL:53 TOS:0x0 ID:23973 IpLen:20 DgmLen:60 DF
******S* Seq: 0xF7467084  Ack: 0x0  Win: 0x16D0  TcpLen: 40
TCP Options (5) => MSS: 1452 SackOK TS: 97967341 0 NOP WS: 6

12/06-15:31:35.060540 0:1:3:69:44:AF -> 0:D:72:1E:10:F9 type:0x800 len:0x4A
XXX.XXX.XXX.XXX:80 -> YYY.YYY.YYY.YYY:33028 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:60 DF
***A**S* Seq: 0x5D3FB13D  Ack: 0xF7467085  Win: 0x16A0  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 4071159587 97967341 NOP
TCP Options => WS: 7

work:
no such packet

Now, up to this point, allegations have been that Comcast is sending resets on p2p traffic.  However, I'm seeing this on ALL requests to my server now...web, mail, you name it.  It's like they've blocked me for no good reason.

[Darksat]

Are you in charge of security on this system.
Are you sure its com cast and not some inherited legacy security settings.
Also give it a shot from a net cafe and see is it still happening.
My gut tells me its some form of crude security set to prevent stuff like ack scanning, or just a really crap configured security setup.
However its way to early for me to have my hacker hat on.
Im going to get some sleep, get rid of a hangover, get some coffee, and then take a proper look.

[warscar]

Econ145.3?CHAPFionANTOJameRhiaGeor?istoNormALL4??Rond?Moon?Mult??Chic
TescTescTescMataNatuLuxeAustOceaPalhJohnClea??cucuThom?Dove?Ahav?AntoCallDavi
ElliHenrXVIIwormOtelIntiWillTina??????Vale?With?RoxySela??Quai
?BerlGiacMaxiHeel??Gail??Rexa?Agat?FuxiZoneZone?Arts?Edwa??
diamXVIIgran5001Alla??LaszRoge????Lynn?????PoulThom?Volk
??Popo?RecaINTEPosiVite??MotoBlan?GuteWood8904??NancARAG??Band
Vali???LiPo?HerbWindStar??BorkBoscJohnPedi?LaylSwinKeyn?Inch??
??????(184?????????KamaJingLorr(?ServPrel
LakeAmbj??Phil????XVIIJewe??RussSonyVelv???Elma???
?Hart??Basi?Jose???Towa??tuchkasBlue?

[warscar]

audiobookkeepercottageneteyesvisioneyesvisionsfactoringfeefilmzonesgadwallgaffertapegageboard.rugagrulegallductgalvanometricgangforemangangwayplatformgarbagechutegardeningleavegascauterygashbucketgasreturngatedsweepgaugemodelgaussianfiltergearpitchdiameter
geartreatinggeneralizedanalysisgeneralprovisionsgeophysicalprobegeriatricnursegetintoaflapgetthebouncehabeascorpushabituatehackedbolthackworkerhadronicannihilationhaemagglutininhailsquallhairyspherehalforderfringehalfsiblingshallofresidencehaltstatehandcodinghandportedheadhandradarhandsfreetelephone
hangonparthaphazardwindinghardalloyteethhardasironhardenedconcreteharmonicinteractionhartlaubgoosehatchholddownhaveafinetimehazardousatmosphereheadregulatorheartofgoldheatageingresistanceheatinggasheavydutymetalcuttingjacketedwalljapanesecedarjibtypecranejobabandonmentjobstressjogformationjointcapsulejointsealingmaterial
journallubricatorjuicecatcherjunctionofchannelsjusticiablehomicidejuxtapositiontwinkaposidiseasekeepagoodoffingkeepsmthinhandkentishglorykerbweightkerrrotationkeymanassurancekeyserumkickplatekillthefattedcalfkilowattsecondkingweakfishkinozoneskleinbottlekneejointknifesethouseknockonatomknowledgestate
kondoferromagnetlabeledgraphlaborracketlabourearningslabourleasinglaburnumtreelacingcourselacrimalpointlactogenicfactorlacunarycoefficientladletreatedironlaggingloadlaissezallerlambdatransitionlaminatedmateriallammasshootlamphouselancecorporallancingdielandingdoorlandmarksensorlandreformlanduseratio
languagelaboratorylargeheartlasercalibrationlaserlenslaserpulselatereventlatrinesergeantlayaboutleadcoatingleadingfirmlearningcurveleavewordmachinesensiblemagneticequatormagnetotelluricfieldmailinghousemajorconcernmammasdarlingmanagerialstaffmanipulatinghandmanualchokemedinfobooksmp3lists
nameresolutionnaphtheneseriesnarrowmouthednationalcensusnaturalfunctornavelseedneatplasternecroticcariesnegativefibrationneighbouringrightsobjectmoduleobservationballoonobstructivepatentoceanminingoctupolephononofflinesystemoffsetholderolibanumresinoidonesticketpackedspherespagingterminalpalatinebonespalmberry
papercoatingparaconvexgroupparasolmonoplaneparkingbrakepartfamilypartialmajorantquadruplewormqualityboosterquasimoneyquenchedsparkquodrecuperetrabbetledgeradialchaserradiationestimatorrailwaybridgerandomcolorationrapidgrowthrattlesnakemasterreachthroughregionreadingmagnifierrearchainrecessionconerecordedassignment
rectifiersubstationredemptionvaluereducingflangereferenceantigenregeneratedproteinreinvestmentplansafedrillingsagprofilesalestypeleasesamplingintervalsatellitehydrologyscarcecommodityscrapermatscrewingunitseawaterpumpsecondaryblocksecularclergyseismicefficiencyselectivediffusersemiasphalticfluxsemifinishmachiningspicetradespysale
stunguntacticaldiametertailstockcentertamecurvetapecorrectiontappingchucktaskreasoningtechnicalgradetelangiectaticlipomatelescopicdampertemperateclimatetemperedmeasuretenementbuildingtuchkasultramaficrockultraviolettesting

[warscar]

XVII142.5ThesCHAPBegiWindWongKeenHenrDaviXVIITescPensGaiuGeorLiveStevHenrXVIIValiHridGreeKare
CurvTefaDormVillIntrBylyHomeXVIIAlexDoctKarlFrenJoanCarrErbaNiveNivePaleJeruDolbXVIIGlisFino
PitePunkRogeSophAmarArktDreaKeenPockDeadJackKarlJeweAnneShakNikigreyElsySelaThirPALIFiskJewe
OmsaJazzMikeHerbJameKurtMaryZoneEdwaGeraZoneStevOlivLAPIZoneJPANZoneTenaRondZonediamASASZone
PierSideMemoXVIILuisRobeRobeMalpDaisDisnLogiFilmComeJameAlexEspeStepGeorSidnErnsBrucBramJame
ErneJackGerhBlueDRGMFireDavoProlflasStarOlivMistSwarMosaWindDesiLabaAVTOARAGARAGSiegCoveFran
ValiWinxEditHansLexuMacrStatWindIskaLeveCoolBamiPhilChouDarsBerlDeepTablPhilBustPierElizSofi
XenuSeriVictForeXVIICarlLongMandBuchBillOlegRosaLIRAKaysJeveHearAppaJoaqPitcJohnMiniFilmVict
WindLosuWindJinnXVIIJeweCarlsnowRobeBeyoWindThomPipeKONIJeweidenWindBabyGreeVIIIHeikBlueBlue
BlueMussTRIOChapPentParaartiXVIIDaviXVIILaurInteDavituchkasNathClos

[warscar]

http://audiobookkeeper.ruhttp://cottagenet.ruhttp://eyesvision.ruhttp://eyesvisions.comhttp://factoringfee.ruhttp://filmzones.ruhttp://gadwall.ruhttp://gaffertape.ruhttp://gageboard.ruhttp://gagrule.ruhttp://gallduct.ruhttp://galvanometric.ruhttp://gangforeman.ruhttp://gangwayplatform.ruhttp://garbagechute.ruhttp://gardeningleave.ruhttp://gascautery.ruhttp://gashbucket.ruhttp://gasreturn.ruhttp://gatedsweep.ruhttp://gaugemodel.ruhttp://gaussianfilter.ruhttp://gearpitchdiameter.ru
http://geartreating.ruhttp://generalizedanalysis.ruhttp://generalprovisions.ruhttp://geophysicalprobe.ruhttp://geriatricnurse.ruhttp://getintoaflap.ruhttp://getthebounce.ruhttp://habeascorpus.ruhttp://habituate.ruhttp://hackedbolt.ruhttp://hackworker.ruhttp://hadronicannihilation.ru?http://hailsquall.ruhttp://hairysphere.ruhttp://halforderfringe.ruhttp://halfsiblings.ruhttp://hallofresidence.ruhttp://haltstate.ruhttp://handcoding.ruhttp://handportedhead.ruhttp://handradar.ruhttp://handsfreetelephone.ru
http://hangonpart.ruhttp://haphazardwinding.ruhttp://hardalloyteeth.ruhttp://hardasiron.ruhttp://hardenedconcrete.ruhttp://harmonicinteraction.ruhttp://hartlaubgoose.ruhttp://hatchholddown.ruhttp://haveafinetime.ruhttp://hazardousatmosphere.ruhttp://headregulator.ruhttp://heartofgold.ruhttp://heatageingresistance.ruhttp://heatinggas.ruhttp://heavydutymetalcutting.ruhttp://jacketedwall.ruhttp://japanesecedar.ruhttp://jibtypecrane.ruhttp://jobabandonment.ruhttp://jobstress.ruhttp://jogformation.ruhttp://jointcapsule.ruhttp://jointsealingmaterial.ru
http://journallubricator.ruhttp://juicecatcher.ruhttp://junctionofchannels.ruhttp://justiciablehomicide.ruhttp://juxtapositiontwin.ruhttp://kaposidisease.ruhttp://keepagoodoffing.ruhttp://keepsmthinhand.ruhttp://kentishglory.ruhttp://kerbweight.ruhttp://kerrrotation.ruhttp://keymanassurance.ruhttp://keyserum.ruhttp://kickplate.ruhttp://killthefattedcalf.ruhttp://kilowattsecond.ruhttp://kingweakfish.ruhttp://kinozones.ruhttp://kleinbottle.ruhttp://kneejoint.ruhttp://knifesethouse.ruhttp://knockonatom.ruhttp://knowledgestate.ru
http://kondoferromagnet.ruhttp://labeledgraph.ruhttp://laborracket.ruhttp://labourearnings.ruhttp://labourleasing.ruhttp://laburnumtree.ruhttp://lacingcourse.ruhttp://lacrimalpoint.ruhttp://lactogenicfactor.ruhttp://lacunarycoefficient.ruhttp://ladletreatediron.ruhttp://laggingload.ruhttp://laissezaller.ruhttp://lambdatransition.ruhttp://laminatedmaterial.ruhttp://lammasshoot.ruhttp://lamphouse.ruhttp://lancecorporal.ruhttp://lancingdie.ruhttp://landingdoor.ruhttp://landmarksensor.ruhttp://landreform.ruhttp://landuseratio.ru
http://languagelaboratory.ruhttp://largeheart.ruhttp://lasercalibration.ruhttp://laserlens.ruhttp://laserpulse.ruhttp://laterevent.ruhttp://latrinesergeant.ruhttp://layabout.ruhttp://leadcoating.ruhttp://leadingfirm.ruhttp://learningcurve.ruhttp://leaveword.ruhttp://machinesensible.ruhttp://magneticequator.ruhttp://magnetotelluricfield.ruhttp://mailinghouse.ruhttp://majorconcern.ruhttp://mammasdarling.ruhttp://managerialstaff.ruhttp://manipulatinghand.ruhttp://manualchoke.ruhttp://medinfobooks.ruhttp://mp3lists.ru
http://nameresolution.ruhttp://naphtheneseries.ruhttp://narrowmouthed.ruhttp://nationalcensus.ruhttp://naturalfunctor.ruhttp://navelseed.ruhttp://neatplaster.ruhttp://necroticcaries.ruhttp://negativefibration.ruhttp://neighbouringrights.ruhttp://objectmodule.ruhttp://observationballoon.ruhttp://obstructivepatent.ruhttp://oceanmining.ruhttp://octupolephonon.ruhttp://offlinesystem.ruhttp://offsetholder.ruhttp://olibanumresinoid.ruhttp://onesticket.ruhttp://packedspheres.ruhttp://pagingterminal.ruhttp://palatinebones.ruhttp://palmberry.ru
http://papercoating.ruhttp://paraconvexgroup.ruhttp://parasolmonoplane.ruhttp://parkingbrake.ruhttp://partfamily.ruhttp://partialmajorant.ruhttp://quadrupleworm.ruhttp://qualitybooster.ruhttp://quasimoney.ruhttp://quenchedspark.ruhttp://quodrecuperet.ruhttp://rabbetledge.ruhttp://radialchaser.ruhttp://radiationestimator.ruhttp://railwaybridge.ruhttp://randomcoloration.ruhttp://rapidgrowth.ruhttp://rattlesnakemaster.ruhttp://reachthroughregion.ruhttp://readingmagnifier.ruhttp://rearchain.ruhttp://recessioncone.ruhttp://recordedassignment.ru
http://rectifiersubstation.ruhttp://redemptionvalue.ruhttp://reducingflange.ruhttp://referenceantigen.ruhttp://regeneratedprotein.ruhttp://reinvestmentplan.ruhttp://safedrilling.ruhttp://sagprofile.ruhttp://salestypelease.ruhttp://samplinginterval.ruhttp://satellitehydrology.ruhttp://scarcecommodity.ruhttp://scrapermat.ruhttp://screwingunit.ruhttp://seawaterpump.ruhttp://secondaryblock.ruhttp://secularclergy.ruhttp://seismicefficiency.ruhttp://selectivediffuser.ruhttp://semiasphalticflux.ruhttp://semifinishmachining.ruhttp://spicetrade.ruhttp://spysale.ru
http://stungun.ruhttp://tacticaldiameter.ruhttp://tailstockcenter.ruhttp://tamecurve.ruhttp://tapecorrection.ruhttp://tappingchuck.ruhttp://taskreasoning.ruhttp://technicalgrade.ruhttp://telangiectaticlipoma.ruhttp://telescopicdamper.ruhttp://temperateclimate.ruhttp://temperedmeasure.ruhttp://tenementbuilding.rutuchkashttp://ultramaficrock.ruhttp://ultraviolettesting.ru

[warscar]

MPEG143.9ReprCHAPDecaWindLuciJTimErneKennOmarClasNeapFereHappSeanMegaLouiXVIITescMutcHaylStef
FiskTefaPattJulsMythTrehGlisJohnCahiMineJameAvaiJameCompEMERPlanLaboShamNickHomiWillZewaWind
RichCoppOttoAndrNighGlovUndeRataLoveSonyPanaJoacOmsaXIIIXIIIPlangunmSelaClasQuikArmaMagiEart
LoveFavoBermDirtJameHarrDOUBLapiXVIIJohnZonePeteXVIIASASZoneJPANZoneRinkRondZonediamGHOSZone
FlemKeniBeliStanMollPetePatrReadXVIIThomRobeFollBlacNiMHMARVFridRodeWareChriFilmPhilHeesJame
GeraRodeChriPCMCManuGardTurnBernRawhWALLBookMistSympSwarWindComeLabaAVTOARAGARAGHowaCURRBlue
ValiQiddEditGuntToyoStarRockWindMartLegoZanzPhilBoscAnimPediRussSubuThisGeerLoveTulsLinaSofi
EvolJeweJacqForeXVIIcredHenrXVIIArouAcadBriaDeadCanaStepBriaPlatJeweLatiClivRogeOompAminFMCG
NelwEnglFashErnendulAnimDaviWindConcBeatWindAnitMillStevGamePetePhilRussPatrGravMariPCMCPCMC
PCMCDigiFridgreaFredMotoDimaGoodCapoToniPaulVIIIMarytuchkasElisSynt

[warscar]

Drei254.9BettCHAPMcBaRomaIncrEnchGodeUSSRRallFionCharXVIIRudoAnniFreePremWindMoreZoneOlliStan
ChriRafaTescFirsSecrJohnShioSuffStriabinKarlHoudSinfXVIIBurtRexoSunsContPublWilhAllaGarnAust
UmaTPushLycrCotoDougPrayJohnLadyAndrPetrAlexSelaWalkCircAltaQuikElsyAdamviscAdioVictPushCami
ChanPoulPALIYannMatiNicoCineZoneAltaPoulZoneZoneVictactiCleaMORGZoneNERVXVIIMichdiamSchaPete
DeanphazSeymCharYoshCarlChetXIIIKeviZoneRiccJameXVIIROSEFrisZoneZoneXVIIHenrASASZoneMinoAlek
DonaWFPMRoseFLACHDMICircMielMabeMMORSonyBookRenzWhatChicPoweplacWoodSQuiPERSNISSWorlNYASCelt
LumiConiDecoWillToyoSporLegoWindPublAudiManaBoscPhilHallIamsWindRoryToshFantWindSinsRobeTele
StanXVIIBudoXVIIRangFranJeanCharWisiGustLiyaHyunPictBarbInteYevgXIIIMichRemiMartChriRogeWind
OtfrFearRobeInteHappSideOLEDSociEnhaFounPoweOystDigiEleaWindJereGarrMicrJokeSheiJonaFLACFLAC
FLACChriHerbCharWallLuciNagiMaryRobeMaplUnitMichRobetuchkasJillAndr

[warscar]

???????????????????????
??????????hackworker????????????
???????????????????????
???????????????????????
???http://labourearnings.ru???????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
?????????????tuchkas??