I have a lenovo laptop, windows 8.1, which apparently recently started flooding the network with nbns packets to a block of ip addresses, which then floods the router. Shortly after unplugging the physical cable or turning off wifi, as it happens over either interface, will clear the problem and other devices can now access the internet. Any additional info on this "flood" would be great: Here is a partial listing from Wireshark (the destination 203.52.141.70 will run sequentially until the last in about 10 seconds of 203.52.255.178, the 3 trials I have run I get differing ip hosts) asked 15 Mar ‘16, 08:49  mmarckese edited 15 Mar ‘16, 10:40 |
One Answer:
Hm, my conclusion is that your notebook has become a zombie in a botnet, and its boss asks it to take part in DDoS-attacks to various networks (note that in this capture, the tagret network differs from the one you've mentioned in your Question). The "NBNS" packets your notebook sends contain a bogus payload, and the "recipient" (actually, target) or some firewall in front of it already filter the attack - see e.g. packet 71, which is an icmp message informing you that you've been blacklisted. The reason why I wanted to see the very beginning after boot was to see the control process of the zombie "calling home" for instruction whom to attack. I'd recommend to cut the laptop off the network immediately and use some good anti-virus software to clean it up. It may be necessary to use a bootable anti-virus or to connect the disk from the laptop as an additional disk to another computer as some viruses can get active before the anti-virus and fool it. answered 15 Mar '16, 11:09  sindy Excellent, to you not the situation. Thank You. (15 Mar '16, 11:26) mmarckese |
Please publish the complete capture file somewhere (preferably cloudshark but dropbox, google drive, MS one drive should do as well) for login-free access and edit your question with a link to it. By text dump of packet headers no one can help you.
The capture should include the beginning of the flood, i.e. if you capture on the laptop which is the source of the flood, you should boot it while isolated from the network in a way which allows to start the capture (i.e. the interface needs to be physically up), then start the capture, and then “unplug” the communication. You may use firewall settings to do that, or another switch which you would connect to the PC before booting it but only connect it to the network after starting the capture.
If you cannot post the capture for privacy reasons, check whether shaving off the payload above the tcp layer using tracewrangler would be secure enough for you.
Hopefully this will help: URL: https://www.cloudshark.org/captures/8635910ab655