source port 19000/TCP DDOS

I realised that I was under a DDOS attack yesterday. Now, this is nothing surprising nor unexpected because this happens every day and every time. The interesting part is that I realised it at all.

Between 20:29:41 and 20:30:23 LT (=UTC+1) I had 450 attempts to reach different ports on my site but coming all from source port 19000. There were 122 distinct IP involved and each IP did exactly try 4 times an attempt with 2 different ports. Therefore each port was checked twice. But no port was checked by more than 1 source IP. Starting with dest port 22 ending at 65443 with big gaps between. So it was coordinated in my opinion. The source IP were coming from around the world. Major part from US with 42% and Canada with 9%. Interesting there is a large white area where normal most of the hacks are coming. All packets did have the SYN flag and it was not the return packet from a lost established session.

It would never catch my eyes or trigger any alert because of four TCP probes per IP is nothing. But the high number of identical source ports was the crucial factor. I could imagine that the idea was to find a weak FW or OS, which opens the port to anywhere on 19000/tcp in the first attempt and the seconds one verifies if this really happened. This indicates that each IP address did probe the same port twice.

Btw, all of the attacking IPs have open ports 554/tcp and 555/tcp (rtsp-proxy) and several other ports too. Not verified all of them but it seems to be that the operating systems are Linux like. And none of them had open port 19000/tcp.

A new experience. Another interesting part is the fact that Russia was not seen as source. For me an indication that hackers from over there are maybe involved.

This is the timeline

This is the geography

Part of the FW log

FW log