Who is injecting data into network packets.

Question

0.00/5 (No votes)

See more:

I use a packet sniffer that i wrote myself and it's a bit like wireshark but is lightweight and seems to be doing a good job but i have noticed packets arriving from the internet after making TCP request out on port 80 for web-pages. This i can check by checking the packet sniffer IP address that also showns up in Syslogs. Note sure about the length of the time lag.

The strange data i am getting always looks the same with the same ID and this is happening on more than one machine with the same id in the data and the data part of the packet looks a bit like this.

"(Ref.Id: ?sufKKsWW98F4Cs2CEW6MM?)"

it's as if i am getting some type of late reply that makes it way past the NAT in the routers firewall due to timing or something and the other thing i have noticed is that the network windows size seems to always be zero which might have something to do with a buffer overrun.

The router i use is a Sonicwall (not much good without a licence, most nice to have's doing work unles you pay them money) so if thats not injecting these packets then it seems like my ISP must be behind this and are using a back-door hack to push data to my network since the router does not map any inbound packets.

I know for a fact that my ISP hijacks DNS lookup's and somehow manages to serve up HTTPS pages from it's servers using the hijacked lookup's so it's not something i would put past them.

Posted 30-Sep-15 7:36am

Dr Gadgit

Add a Solution

3 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Patrice T · Answer 1 · 2015-09-30T10:23:00

Quote:
The router i use is a Sonicwall (not much good without a licence, most nice to have's doing work unles you pay them money) so if thats not injecting these packets then it seems like my ISP must be behind this and are using a back-door hack to push data to my network since the router does not map any inbound packets.

Use pfSense freeware router instead.
https://www.pfsense.org/[^]

Dr Gadgit · Answer 2 · 2015-10-13T06:54:00

Well these strange bits of packet data I caught

"(Ref.Id: ?sufKKsWW98F4Cs2CEW6MM?)"

Are connected to SSL Certificate requests and it seems to be Visual Studio thats sending them out as programs are running in debug mode and using VHost.

Now i know VS2010 likes to have an internet connection because it often crashes without one, been well documented over the years but your guess is as good as mine as to why it needs a secure connection to call home.

Dr Gadgit · Answer 3 · 2015-10-02T07:21:00

I tried to get pfSense working on an old laptop but it could only see one of the network cards so i gave in.

For the money these DrayTek routers are good but i've stuck with the Sonicwall only because it can do outbound NAT mapping so it can send any requests that were going to microsoft or google back to the LAN to be processed by a DNS server or proxy server.

Google pulls every trick in the book to hack details from your machine, you cannot block it all but i now used man-in-the-middle on my proxy server to fix the scripts on the fly.

I also wanted to block microsoft, like all 20 million ip's and started to type lots of ip-ranges into my firewall to block them but it started to look a big mess so I now block microsoft using a few ASNs in the DNS server using a local whois lookup from a XML file that might not be upto date but get it right most of the time.

Another trick is to pull SSL-Certificate to see who realy owns what site and then block based on that.

Still don't have a clue where these messages are coming from, it's the sonicwall or my ISP pushing something to my network, no one seems to know

Who is injecting data into network packets.

3 solutions

Solution 1

Solution 3

Solution 2

Add your solution here

Preview 0