[unisog] Interesting traffic

hermit921 hermit921 at yahoo.com
Fri Feb 6 22:55:59 GMT 2004

We see it, too, starting about the same time.  One packet every few 
seconds, to what appears to be random addresses in our class B.  Most 
addressed to subnets that don't exist.  Still going on.


At 06:29 AM 2/6/2004, Asadoorian, Paul D wrote:
>This traffic started on my network on Feb. 2nd, at 7:00AM EST STD time.
>They all originate from, all with a source port of 6667
>TCP, the destination is my entire class B on TCP ports 1024 and 3072.
>All packets are RST/ACK.  Anyone else seeing this IP hitting their
>network?  Looks like someone is spoofing our address space, and I have
>confirmed that at least one other University is seeing this.
>Paul Asadoorian, GCIA
>Brown University
>115 Waterman St.
>Providence, RI 02912
>PGP Key: http://pauldotcom.com/Paul_Asadoorian.asc
>Fingerprint: 42CB D9A8 37C4 2D1C A2FE  927F C946 9174 41DC 7A4F
>Web: http://www.pauldotcom.com

More information about the unisog mailing list