Yes, I started to see this at 13:22 (GMT) yesterday, as you say
to specific IP addresses, between 3 and 6 packets each time. It
continued to 20:55 (GMT) last night.
Andy
--
Andy Condliffe
Technical Consultant BusinessNet
Tel:(+44) 171 390 9902 Fax:(+44) 171 390 9944
Email: [EMAIL PROTECTED] http://www.business.net.uk
Roger Marquis wrote:
>
> We recently began seeing an interesting pattern of tcp packets, from 6
> unique IPs, none with reverse dns, 5 or 6 packets per src IP to a single
> destination IP, port 7 (echo). These packets are all logged within a few
> seconds of each other which leads me to suspect that most of them could be
> spoofed. The "source" IPs are:
>
> 199.95.207.91 DOUBLECLICK.NET
> 199.95.208.85 DOUBLECLICK.NET
> 207.239.35.71 @PLAN (webplan.net)
> 208.32.211.71 DOUBLECLICK.NET
> 209.67.38.49 EXODUS.NET (no reverse dns in subnet)
> 209.67.38.50 EXODUS.NET (no reverse dns in subnet)
>
> Anyone else seen this traffic pattern?
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
