🚀 go-pugleaf

Michael - that street address is an office building occupied at least in part
by ISI, a research outfit closely related to the USC School of Engineering
Depts of Comp Sci & EE. They've been very closely involved with development
of Arpanet & the internet since the beginning. You might nose around
<http://www.isi.edu>, and even place a phone call to their front office in
Suite 1001 if you're really concerned.

Michael Scheidell wrote:

> I saw (a spoofed) netbios scan today from 90.0.0.1
> I kow about the rfc-1918 addresses (10.0.0.0/8, 192.168, 172.16, and the
> stuff ms uses on broken dhcp clients, 169.254)
>
> so, what is 90.0.0.1? whois -h arin.net shows
> IANA (RESERVED-7)
>    4676 Admiralty Way, Suite 330
>    Marina del Rey, CA 90292-3607
>    US
>
>    Netname: RESERVED-7
>    Netblock: 67.0.0.0 - 95.255.255.255
>
> obviosly, somebody is routing it (else what good would a udp scan do?)
> traceroute stops at border router.
>
> so, is this yet another spoofed address we add to the bastian router
> filters?
>
> time="2001-03-15 09:03:09" pri=5 c=128 m=37 msg="UDP packet dropped" n=40
> src=90.0.0.1:137:WAN dst=216.78.194.186:137:LAN^M
>
> time="2001-03-15 09:03:10"  pri=5 c=128 m=37 msg="UDP packet dropped" n=42
> src=90.0.0.1:137:WAN dst=216.78.194.186:137:LAN^M
>
> --
> Michael Scheidell
> Florida Datamation, Inc.
> scheidell@fdma.com / 1+(561) 368-9561
> Internet Security and Consulting
> See updated IT Security News at http://www.fdma.com