said by Lawrence from other post:

---

Thanks...unfortunately you seem to be even further away from the source than I am...so far psloss (LAX area) is the closest...he's a total of 16 hops from the spammer (ending TTL of 48).

Do we have anyone else here on roadrunner West coast...San Diego or San Franscisco would be perfect---that can run this test.

---

said by kpatz :

---

Do we have to use Ethereal? I've used a homebrew listener on my Linux box to capture messenger spam dating back to April, I have nearly 3,000 samples comprising of approximately 200 unique messenger spam texts. They're cataloged in a MS Access 97 database. If you like I can dump this data into a format you can use and send it to you.

---

said by kpatz :

---

I don't have the full (raw) UDP headers, but I do have the following information (as reported by ipchains): Date, Time, Protocol, Source IP, Source Port, Destination IP, Destination Port, Packet Length, TOS, IP ID (sequence), flags/fragmentation offset, TTL. I also have the text of the spam itself, but not the header information in the spam packet (I can pull this from the capture logs though, they just aren't in the Access DB).

---

said by kpatz :

---

I don't have the full (raw) UDP headers, but I do have the following information ...**TTL**.

---

said by Bubba :

---

If so....does the below comment from that thread still hold true ? Would love to help but I'm 2000+ miles away.
HR>

said by NetWatchMan :

---

That's all you really need then...but I'm really truely interested if you receive an Spam from a source that is *close* to you. Can you craft a query to your Access db that finds cases where (Powerof2 - TTL) TTL).

---

said by NetWatchMan :

---

SPAM Net is widening, currently:

1) Atlanta, GA - Comcast
2) Orange Cnty, CA - Roadrunner
3) New York, NY - Verizon
4) San Jose, CA - Speakeasy
5) San Diego, CA - setup in process
6) San Fran, CA - setup in process
7) Memphis, TN - Roadrunner

Keep it coming...

---

said by NetWatchMan :

---

Unfortunately, I'm also convinced that this joker is sending the traffic using a *forged* IP address from two different locations...I'm pretty sure they are both in the US or Canada.

When I receive this traffic I note that he ending TTL (time-to-live) in the packets are 48 and 53. Assuming a starting TTL of 64, that would mean the spammer is only 16 and 11 hops away from me, respectively. Thus, my conclusion that this traffic is NOT actually coming from China, but much more local.

This is a good opportunity to test an idea that I've had for backtracing the source of spoofed traffic...I call it "TTL Triangulation" ... it works much like a GPS receiver...by collecting spam packets from various locations and comparing the TTLs we should be able to hone in where the actually source of this traffic is.

So I ask anyone here that wants to participate and has the ability to take full packet captures of inbound Messenger spam to capture packets from this IP and email them to me.

My guide to setting up Ethereal is here:
»www.mynetwatchman.com/pckidiot

You'll want to enter the following string in the 'Filter' box on the Capture screen:

[edit for new filter]
(port 135 or port 1026 or port 1027 or port 1028 or port 1029)

Feel free to email or phone me, I'll be happy to give some one-on-one help if you're not clear on how to set this up.

+1.678.624.0924
support (at) mynetwatchman . com

Note the TTL value in the example packet...the closer your value is to 64 the closer YOU are to the spammer...if I can at least identify which ISP he's using I can nab him.
--
Lawrence Baldwin

myNetWatchman

The Internet Neighborhood Watch
[text was edited by author 2003-09-20 10:01:51]

---