Re: Scan traffic from 121.8.0.0/16

2008-03-06 Thread Jon R. Kibler
Rich Sena wrote: Anyone seeing anything similar - trying to determine if this is spoofed etc... Why would you think it is a problem? It's China Telecom. What else would you expect? Off the sarcastic and onto the serious, I am seeing hits on 53/UDP and 25/TCP from a couple of hosts in

Re: Scan traffic from 121.8.0.0/16

2008-03-06 Thread Justin Shore
Rich Sena wrote: Anyone seeing anything similar - trying to determine if this is spoofed etc... I haven't picked up any SSH or telnet scans from that network. That's what I'm looking for at the moment. The amount of scans we're getting are quite impressive at times. I wish there was an

Re: 3rd party network monitoring

2008-03-06 Thread John A. Kilpatrick
On Wed, 5 Mar 2008, Tom Sands wrote: When we did get a hold of someone, they mentioned they could support simple ICMP requests. To them simple means it's just a ping check. They won't montior/graph/care about latency. I was pondering creating a smoke ping collective. Get a bunch of guys

Re: 3rd party network monitoring

2008-03-06 Thread Jeroen Massar
John A. Kilpatrick wrote: On Wed, 5 Mar 2008, Tom Sands wrote: When we did get a hold of someone, they mentioned they could support simple ICMP requests. To them simple means it's just a ping check. They won't montior/graph/care about latency. I was pondering creating a smoke ping

RE: Scan traffic from 121.8.0.0/16

2008-03-06 Thread Tomas L. Byrnes
Have you queried the DShield database for the hosts you are seeing? http://www.dshield.org/ipinfo.html?ip= add the IP after the = -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Sena Sent: Thursday, March 06, 2008 12:02 PM To: NANOG