Suis-je victime d'une attaque réseau?

[Infosciences]

Bonjour,

J’ai récemment vérifier le log de sécurité de mon routeur, et j’ai trouvé ça :

07/31/2011 13:55:53 192.168.2.7 login success
07/31/2011 13:55:50 User from 192.168.2.7 timed out
07/31/2011 13:38:02 sending ACK to 192.168.2.7
07/31/2011 13:36:04 sending ACK to 192.168.2.5
07/31/2011 13:18:21 SYN Flood to Host 192.168.2.7, 52263->> 83.243.19.11, 80 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50329->> 184.73.79.211, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50346->> 204.236.233.174, 5242 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50054->> 50.19.123.166, 5242 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50055->> 75.101.179.246, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50543->> 50.17.56.223, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50776->> 67.202.45.10, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50787->> 75.101.201.30, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50789->> 184.72.206.238, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 50812->> 75.101.193.167, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 51171->> 184.72.155.69, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 51181->> 50.17.89.101, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 51247->> 174.129.89.235, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 51388->> 72.44.44.177, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 51402->> 67.202.38.32, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 51549->> 50.19.29.193, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 51745->> 184.72.211.65, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 51800->> 75.101.177.212, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:23 TCP FIN Scan 192.168.2.6, 52099->> 184.73.52.240, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:22 TCP FIN Scan 192.168.2.6, 57419->> 50.16.175.157, 4244 (from PPPoE1 Outbound)
07/31/2011 13:15:22 TCP FIN Scan 192.168.2.6, 59004->> 50.16.236.28, 5242 (from PPPoE1 Outbound)
07/31/2011 13:15:22 TCP FIN Scan 192.168.2.6, 59009->> 107.20.254.194, 5242 (from PPPoE1 Outbound)
07/31/2011 13:12:57 SYN Flood to Host 192.168.2.7, 32847->> 83.243.19.11, 80 (from PPPoE1 Outbound)
07/31/2011 13:07:57 192.168.2.7 login success

Un extrait plus inquiétant :

07/31/2011 14:15:50 UDP flood 78.21.198.79, 7215->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:49 UDP Flood (per Min) 46.11.6.68, 63091->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:49 UDP flood 46.11.6.68, 63091->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:49 UDP Flood (per Min) 90.227.11.242, 32665->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:49 UDP flood 90.227.11.242, 32665->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP Flood (per Min) 124.79.99.134, 20943->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP flood 124.79.99.134, 20943->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP Flood (per Min) 118.250.181.108, 16001->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP flood 118.250.181.108, 16001->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP Flood (per Min) 90.202.38.242, 19552->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP flood 90.202.38.242, 19552->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP Flood (per Min) 77.204.203.20, 18641->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP flood 77.204.203.20, 18641->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP Flood (per Min) 218.83.248.118, 16001->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:48 UDP flood 218.83.248.118, 16001->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:47 UDP Flood (per Min) 183.80.243.110, 10033->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:47 UDP flood 183.80.243.110, 10033->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:47 UDP Flood (per Min) 114.39.236.102, 19379->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:47 UDP flood 114.39.236.102, 19379->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:47 UDP Flood (per Min) 192.168.2.3, 123->> 196.216.249.2, 123 (from PPPoE1 Outbound)
07/31/2011 14:15:47 UDP flood 192.168.2.3, 123->> 196.216.249.2, 123 (from PPPoE1 Outbound)
07/31/2011 14:15:47 UDP Flood (per Min) 203.206.166.147, 52634->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:47 UDP flood 203.206.166.147, 52634->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:47 UDP Flood (per Min) 121.54.126.131, 8176->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:47 UDP flood 121.54.126.131, 8176->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:46 UDP Flood (per Min) 109.172.31.14, 19858->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:46 UDP flood 109.172.31.14, 19858->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:46 UDP Flood (per Min) 115.235.37.184, 2076->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:46 UDP flood 115.235.37.184, 2076->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:02 UDP Flood (per Min) 123.192.76.94, 15377->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:15:02 UDP flood 123.192.76.94, 15377->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:14:58 sending ACK to 192.168.2.2
07/31/2011 14:14:50 192.168.2.7 login success
07/31/2011 14:14:49 UDP Flood (per Min) 114.161.251.2, 23785->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
07/31/2011 14:14:16 NTP Date/Time updated.
08/01/2003 00:00:21 UDP Flood to Host 195.241.100.167, 23373->> 41.248.183.202, 43006 (from PPPoE1 Inbound)
08/01/2003 00:00:21 If(PPPoE1) PPP connection ok !

Y-a-t-il une raison de s’inquiéter? S’agit-il d’un attaque réseau? Sinon, à quoi correspondent les termes “TCP FIN Scan”, “SYN Flood to Host”, ou même “VECNA Scan” ?

Merci d’avance pour vos réponses.
Edité le 31/07/2011 à 16:21

[trekker92]

tcp fin scan : un scan de ports ?
syn flood to host : une DDoS ?
pour el dernier jsais pas…

[Grawok]

l’UDP flood en inbound peut correspondre à n’importe quel zombie qui fait des tentatives aléatoires à la recherche de faille. Ca arrive en permanence sur l’interface côté Internet. Pas de quoi s’inquiéter si le firewall fait son boulot.

Par contre les premiers logs montrent une tentative de flux sortant (outbound) depuis une machine du réseau local (192.168.2.6). Ca peut être dû à un malware ou toute appli p2p qui cherche à se connecter à des pairs sur Internet sur les ports 4244,5242 (Viber?) . Un scan du PC peut s’averer utile si ces logs se renouvellent régulièrement.