[Dshield] Reserved addresses showing up in logs?

Bob Savage bsavage at rnr-inc.com
Fri May 17 19:29:17 GMT 2002


We just brought up a new ISA server and we're testing.

Web access works.  We can get out to our ISP, open web pages, etc.

In the logs we're seeing a lot of entries like this:

2002-05-17	19:14:03	192.168.100.20	224.0.0.1	2
-	-	BLOCKED	209.224.2.128
2002-05-17	19:14:42	192.168.100.89	192.168.100.255	Udp
137	137	BLOCKED	209.224.2.128
2002-05-17	19:14:43	192.168.100.89	192.168.100.255	Udp
137	137	BLOCKED	209.224.2.128
2002-05-17	19:14:44	192.168.100.89	192.168.100.255	Udp
137	137	BLOCKED	209.224.2.128
2002-05-17	19:14:45	192.168.100.89	192.168.100.255	Udp
137	137	BLOCKED	209.224.2.128
2002-05-17	19:14:46	192.168.100.89	192.168.100.255	Udp
137	137	BLOCKED	209.224.2.128
2002-05-17	19:14:46	192.168.100.89	192.168.100.255	Udp
137	137	BLOCKED	209.224.2.128
2002-05-17	19:14:54	192.168.55.1	255.255.255.255	Udp
68	67	BLOCKED	209.224.2.128
2002-05-17	19:14:54	192.168.55.1	255.255.255.255	Udp
67	68	BLOCKED	209.224.2.128
2002-05-17	19:15:02	192.168.55.1	255.255.255.255	Udp
67	68	BLOCKED	209.224.2.128
2002-05-17	19:15:03	192.168.100.20	224.0.0.1	2
-	-	BLOCKED	209.224.2.128
2002-05-17	19:15:10	192.168.55.1	255.255.255.255	Udp
68	67	BLOCKED	209.224.2.128
2002-05-17	19:15:10	192.168.55.1	255.255.255.255	Udp
67	68	BLOCKED	209.224.2.128
2002-05-17	19:15:17	192.168.100.20	255.255.255.255	9
-	-	BLOCKED	209.224.2.128


It's my understanding that the 192.... numbers are reserved, not public.
We don't use them in our network.  What's going on here?


Bob Savage
IT Manager
RNR, Inc.




More information about the list mailing list