[Dshield] Internap

Bob Poortinga bobp+dshield at webster.tsc.com
Wed Mar 23 19:39:13 GMT 2005


"Paul Marsh" <pmarsh at nmefdn.org> reports:
 
> 	I've been noticing the following IP's scanning me with the
> following source ports.
> 
> 	206.253.195.6 33435 udp
> 	206.253.195.10 33436 udp
> 	206.253.195.14 33437 udp
> 	206.253.195.18 33438 udp
> 	206.253.195.26 33440 udp
... 
> 	The question is, what are these scans?

Probably one of these (or similar) products:
 <http://www.quova.com/technology/ip-mapping-geopoint.shtml>
 <http://www.f5.com/f5products/products/bigip/index.html>

There are a number of products like these that use traceroutes for geolocation
or path optimization.

USA Today uses (or used at one time) one of these products or something similar.
Try browsing <www.usatoday.com> and watch the traceroutes come flying in.

-- 
Bob Poortinga  K9SQL
Bloomington, Indiana  US



More information about the list mailing list