[unisog] Interesting traffic
hermit921 at yahoo.com
Fri Feb 6 22:55:59 GMT 2004
We see it, too, starting about the same time. One packet every few
seconds, to what appears to be random addresses in our class B. Most
addressed to subnets that don't exist. Still going on.
At 06:29 AM 2/6/2004, Asadoorian, Paul D wrote:
>This traffic started on my network on Feb. 2nd, at 7:00AM EST STD time.
>They all originate from 220.127.116.11, all with a source port of 6667
>TCP, the destination is my entire class B on TCP ports 1024 and 3072.
>All packets are RST/ACK. Anyone else seeing this IP hitting their
>network? Looks like someone is spoofing our address space, and I have
>confirmed that at least one other University is seeing this.
>Paul Asadoorian, GCIA
>115 Waterman St.
>Providence, RI 02912
>PGP Key: http://pauldotcom.com/Paul_Asadoorian.asc
>Fingerprint: 42CB D9A8 37C4 2D1C A2FE 927F C946 9174 41DC 7A4F
More information about the unisog