Hi List, I've been receiving this traffic for a while from the same IP address. Does anyone have any idea what type of traffic this might be. Neither the source IP or the target IP have any ports associated with them in this event. Any ideas would be appreciated. I haven't looked into this extensively, figured I'd ask the list first.
Event: ICMP Destination Unreachable Port Unreachable Category: misc-activity Level: 3 Sensor: IDS-1 (1) Date / Time: 08/15/2006 13:22:33 Module: xxxx Event ID: 5769 Original Event ID: 5723 Source: 82.246.252.214 : 0 Destination: x.x.x.49 : 0 -- Payload Length: 145 000 : 00 00 00 00 45 00 00 8D 30 55 00 00 6D 11 03 B2 ....E...0U..m... 010 : 46 5B 83 31 52 F6 FC D6 3F 65 0A 25 00 79 2D E3 F[.1R...?e.%.y-. 020 : 7F 70 02 30 F0 EF 5B 4A A8 5A A2 E0 22 C7 26 F9 p.0..[J.Z..".&. 030 : 09 C7 E7 11 CC E6 03 24 64 92 0C D1 75 B4 4C 36 .......$d...u.L6 040 : 4B 1D F7 97 DC B8 A2 59 9D E2 81 E0 1B 5C 56 E7 K......Y.....\V. 050 : E9 86 F5 F1 89 A8 E3 77 56 D5 8D B6 69 C9 FD 3F .......wV...i..? 060 : D2 76 94 0B 54 AF 8F 79 52 4D 05 50 34 19 5F BE .v..T..yRM.P4._. 070 : 29 F5 48 EE 19 0C 10 5B C7 66 A2 A4 1A D8 D3 29 ).H....[.f.....) 080 : 74 42 C5 37 B0 3F 92 B7 1C 32 F2 14 55 FC 68 02 tB.7.?...2..U.h. 090 : B8 . -- Regards, Adriel T. Desautels SNOsoft Research Team Office: 617-924-4510 || Mobile : 857-636-8882 ---------------------------------------------- Vulnerability Research and Exploit Development BullGuard Anti-virus has scanned this e-mail and found it clean. Try BullGuard for free: www.bullguard.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/