Re: IPIP (IP Protocol 94) Probe?

Article View: comp.security.firewalls

Article #78

Back to comp.security.firewalls Previous Next

#78

From: Michael Scheidell
Date: Wed, 11 Apr 2001 03:10

24 lines
1858 bytes

your dynamic ip address?
remember the port 13121 i reported?
checked my logs

started 2 mins after SW got a new ip addresws (one of the PPoE ones I have)

so, someone has their own private tunneling, OR are trying to trash your
system
(DDOS attack?)


"Lawrence Baldwin" <baldwinl@mynetwatchman.com> wrote in message
news:MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net...
> [This followup was posted to comp.security.firewalls and a copy was sent
to the cited author.]
>
> Here was a pretty bizzare probe received today:
>
> http://www.mynetwatchman.com/kb/security/research/ipip.htm
>
> --
> Lawrence Baldwin
> myNetWatchman.com
> Automatic Port Scan Reporting: http://www.mynetwatchman.com/vision.htm

Technical Details

Message-ID: <%WPA6.121$Jd.34553@news2.mia>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.tele.dk!128.230.129.106!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news2.mia.POSTED!not-for-mail

References: <MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,36dd554aa7cf6f1b
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,36dd554aa7cf6f1b
X-Google-Attributes: gid10090f,public
X-Google-ArrivalTime: 2001-04-10 20:13:18 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.tele.dk!128.230.129.106!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news2.mia.POSTED!not-for-mail
Reply-To: "Michael Scheidell" <scheidell@fdma.com>
From: "Michael Scheidell" <me@privacy.net>
Newsgroups: comp.security.firewalls,bellsouth.net.security
References: <MPG.153d5dd2434544c19896a0@news2.mia.bellsouth.net>
Subject: Re: IPIP (IP Protocol 94) Probe?
Lines: 26
Organization: None
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Message-ID: <%WPA6.121$Jd.34553@news2.mia>
Date: Tue, 10 Apr 2001 23:10:50 -0400
NNTP-Posting-Host: 216.78.192.125
X-Trace: news2.mia 986958651 216.78.192.125 (Tue, 10 Apr 2001 23:10:51 EDT)
NNTP-Posting-Date: Tue, 10 Apr 2001 23:10:51 EDT

Reply to Parent Message