🚀 go-pugleaf

Michael - that street address is an office building occupied at least in part
by ISI, a research outfit closely related to the USC School of Engineering
Depts of Comp Sci & EE. They've been very closely involved with development
of Arpanet & the internet since the beginning. You might nose around
<http://www.isi.edu>, and even place a phone call to their front office in
Suite 1001 if you're really concerned.

Michael Scheidell wrote:

> I saw (a spoofed) netbios scan today from 90.0.0.1
> I kow about the rfc-1918 addresses (10.0.0.0/8, 192.168, 172.16, and the
> stuff ms uses on broken dhcp clients, 169.254)
>
> so, what is 90.0.0.1? whois -h arin.net shows
> IANA (RESERVED-7)
>    4676 Admiralty Way, Suite 330
>    Marina del Rey, CA 90292-3607
>    US
>
>    Netname: RESERVED-7
>    Netblock: 67.0.0.0 - 95.255.255.255
>
> obviosly, somebody is routing it (else what good would a udp scan do?)
> traceroute stops at border router.
>
> so, is this yet another spoofed address we add to the bastian router
> filters?
>
> time="2001-03-15 09:03:09" pri=5 c=128 m=37 msg="UDP packet dropped" n=40
> src=90.0.0.1:137:WAN dst=216.78.194.186:137:LAN^M
>
> time="2001-03-15 09:03:10"  pri=5 c=128 m=37 msg="UDP packet dropped" n=42
> src=90.0.0.1:137:WAN dst=216.78.194.186:137:LAN^M
>
> --
> Michael Scheidell
> Florida Datamation, Inc.
> scheidell@fdma.com / 1+(561) 368-9561
> Internet Security and Consulting
> See updated IT Security News at http://www.fdma.com

"Dan Seur" <click@casta.net> wrote in message
news:3AB0DD39.807C6FED@casta.net...
> Michael - that street address is an office building occupied at least in
part
> by ISI, a research outfit closely related to the USC School of Engineering
> Depts of Comp Sci & EE. They've been very closely involved with
development
> of Arpanet & the internet since the beginning. You might nose around
> <http://www.isi.edu>, and even place a phone call to their front office in
> Suite 1001 if you're really concerned.

Well, it is non routable (must be blocked at border routers) like the
private-rfc1918 addresses

I doubt seriously if isi is hacking, rather it is a spoofed ip address, just
caught me by suprise

>
> Michael Scheidell wrote:
>
> > I saw (a spoofed) netbios scan today from 90.0.0.1
> > I kow about the rfc-1918 addresses (10.0.0.0/8, 192.168, 172.16, and the
> > stuff ms uses on broken dhcp clients, 169.254)
> >
> > so, what is 90.0.0.1? whois -h arin.net shows
> > IANA (RESERVED-7)
> >    4676 Admiralty Way, Suite 330
> >    Marina del Rey, CA 90292-3607
> >    US
> >
> >    Netname: RESERVED-7
> >    Netblock: 67.0.0.0 - 95.255.255.255
> >
> > obviosly, somebody is routing it (else what good would a udp scan do?)
> > traceroute stops at border router.
> >
> > so, is this yet another spoofed address we add to the bastian router
> > filters?
> >
> > time="2001-03-15 09:03:09" pri=5 c=128 m=37 msg="UDP packet dropped"
n=40
> > src=90.0.0.1:137:WAN dst=216.78.194.186:137:LAN^M
> >
> > time="2001-03-15 09:03:10"  pri=5 c=128 m=37 msg="UDP packet dropped"
n=42
> > src=90.0.0.1:137:WAN dst=216.78.194.186:137:LAN^M
> >
> > --
> > Michael Scheidell
> > Florida Datamation, Inc.
> > scheidell@fdma.com / 1+(561) 368-9561
> > Internet Security and Consulting
> > See updated IT Security News at http://www.fdma.com
>

In article <98qk3f$1mcq$1@caerulus.cerintha.com>, me2@privacy.net says...
> I saw (a spoofed) netbios scan today from 90.0.0.1
> I kow about the rfc-1918 addresses (10.0.0.0/8, 192.168, 172.16, and the
> stuff ms uses on broken dhcp clients, 169.254)
> 
> so, what is 90.0.0.1? whois -h arin.net shows
> IANA (RESERVED-7)
>    4676 Admiralty Way, Suite 330
>    Marina del Rey, CA 90292-3607
>    US
> 
>    Netname: RESERVED-7
>    Netblock: 67.0.0.0 - 95.255.255.255
> 
> obviosly, somebody is routing it (else what good would a udp scan do?)
> traceroute stops at border router.
> 
> so, is this yet another spoofed address we add to the bastian router
> filters?
> 
> time="2001-03-15 09:03:09" pri=5 c=128 m=37 msg="UDP packet dropped" n=40
> src=90.0.0.1:137:WAN dst=216.78.194.186:137:LAN^M
> 
> time="2001-03-15 09:03:10"  pri=5 c=128 m=37 msg="UDP packet dropped" n=42
> src=90.0.0.1:137:WAN dst=216.78.194.186:137:LAN^M
> 
> --
> Michael Scheidell
> Florida Datamation, Inc.
> scheidell@fdma.com / 1+(561) 368-9561
> Internet Security and Consulting
> See updated IT Security News at http://www.fdma.com
> 
> 
> 
Take a look at:

http://www.isi.edu/in-notes/iana/assignments/ipv4-address-space

and you'll see that the 90.x.x.x block falls into a reserved address 
space.

---Matthew