I have discovered a strange issue, and I hope someone can help me to fix it. If I'm capturing the ip packets on em1 network interface on port 53 with the "tcpdump -i em1 -vvv -s 0 -l -n port 53" command I'm getting strange result( below is a piece of them), continuously are coming packets from unknown IPs(4-5 IP repeatedly). On the server runs centos7 and Bind9 DNS server. If I turn the named service or the networking service off, the packets are still coming. I changed the private IP of the server from 10.10.10.100 to 10.10.10.xxx and the problem is still alive, ip packets are coming continuously to the original 10.10.10.100 IP. I have restarted the server several time, no result.
My question is that, can I ignore this? Is that a ddos like attack? Based on the fact that, with networking service off, the problem still persist, I think this can be a bug or a virus. Is it?
09:13:28.941958 IP (tos 0x20, ttl 105, id 12674, offset 0, flags [DF], proto TCP (6), length 52) 107.167.18.163.32902 > 10.10.10.100.domain: Flags [S], cksum 0x9538 (correct), seq 2019438094, win 8192, options [mss 1452,nop,wscale 8,nop,nop,sackOK], length 0 09:13:28.942006 IP (tos 0x20, ttl 64, id 41456, offset 0, flags [DF], proto TCP (6), length 40) 10.10.10.100.domain > 107.167.18.163.32902: Flags [.], cksum 0x328e (correct), seq 0, ack 1, win 14600, length 0 09:13:29.128215 IP (tos 0x20, ttl 103, id 54720, offset 0, flags [DF], proto TCP (6), length 52) 107.167.18.163.32902 > 10.10.10.100.domain: Flags [S], cksum 0x35d2 (correct), seq 2106165321, win 8192, options [mss 1452,nop,wscale 8,nop,nop,sackOK], length 0
The server is behind a cisco router, and on the router is a NAT rule(86.34.156.51 <-> 10.10.10.100). In the BIND DNS server I had to setup the local private IP, otherwise if the bind was configured with public IP, the DNS packets never arrived to the host which made the request, (probably the router interpreted that the 86.34.156.51 must to route back to the host (10.10.10.100)). An other issue related to this is that, the DNS packet's TTL value is always 0 when arrived to the destination host.
Here is the result with -A flag
"tcpdump -i em1 -A -vvv -s 0 -l -n port 53"
11:16:22.681589 IP (tos 0x20, ttl 77, id 55139, offset 0, flags [DF], proto TCP (6), length 52) 107.167.22.93.59026 > 10.10.10.100.domain: Flags [S], cksum 0x47a6 (correct), seq 1337080454, win 8192, options [mss 1452,nop,wscale 8,nop,nop,sackOK], length 0 E .4.c@.M...k..] d...5O.:....... .G............... 11:16:22.681638 IP (tos 0x20, ttl 64, id 28261, offset 0, flags [DF], proto TCP (6), length 40) 10.10.10.100.domain > 107.167.22.93.59026: Flags [.], cksum 0xd525 (correct), seq 0, ack 1, win 14600, length 0 E .(ne@.@.5. dk..].5..kT na.7|P.9..%..