OT - Am I being probed or ?

Empty plug at emptiedout.com
Sat Jan 6 16:06:30 MST 2007


That might not be the best idea.... A lot of networks use RFC1918 space
on their routing gear, and sometimes on internal servers. Just because
the internet should not route it doesn't mean your network (eg your isp)
does not.

~Ben

Randy Melder wrote:
> never say never...
> 
> The 10.x.x.x network is 'reserved' for private use, but alas... our
> enemies to the east route these address blocks for black hat ops.
> 
> Your router ACL should include rules denying traffic inbound from the
> private networks:
> 10.0.0.0 <http://10.0.0.0> /8
> 172.16.0.0 <http://172.16.0.0> /12 (I think)
> 192.168.0.0 <http://192.168.0.0> /16
> 
> It sounds like this rule isn't in force and you'll need to implement per
> your router setup.
> 
> ; ) .randy
> 
> 
> 
> On 1/5/07, *Jon M. Hanson* <jon at the-hansons-az.net
> <mailto:jon at the-hansons-az.net>> wrote:
> 
>     An IP address starting with 10 Is a private address and is not
>     routeable on the Internet. Someone is likely spoofing their source
>     address if you're not using that as your network.
> 
>     As far as your ISP probing port 80, it may be against your Terms of
>     Service to run a webserver so they may be checking if you are.
> 
>     ------- Original Message -------
>     From: Dazed_75 <lthielster at gmail.com <mailto:lthielster at gmail.com>>
>     To: "Main PLUG discussion list" <
>     plug-discuss at lists.plug.phoenix.az.us
>     <mailto:plug-discuss at lists.plug.phoenix.az.us>>
>     Sent: 01/05/07, 05:19:05 PM
>     Subject: OT - Am I being probed or ?
> 
>     The incoming log on my router shows repeatedly blocking 10.20.71.1
>     <http://10.20.71.1> from
>     accessing a port? name of bootpc using udp.  What does this mean?
> 
>     The other one I see repeating seems to be form my ISP (Mediacom) who
>     apparently leases facilities from AT&T.  that is 12.201.126.113
>     <http://12.201.126.113> sending TCP
>     traffic to a port identified in the log as WWW.  Any idea why they
>     would be
>     doing that (whatever it is).
> 
>     BTW, my router is a Linksys WRT54GL with *v4.71.1, Hyperwrt 2.1b1 +
>     Thibor15c [May 12 2006]*
> 
>     --
>     Be who you are and say what you feel, because those who mind don't
>     matter
>     and those who matter don't mind.  - Dr. Seuss
> 
>     ---------------------------------------------------
>     PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
>     <mailto:PLUG-discuss at lists.plug.phoenix.az.us>
>     To subscribe, unsubscribe, or to change  you mail settings:
>     http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
> 
> 
> 
> 
> -- 
> 
> 
> 
> http://spindomains.us/
> 
> 
> ------------------------------------------------------------------------
> 
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

-- 
---
"Confession only helps if you actually feel bad for your actions.
For you, it would just be a really long boast."
	-Tara
http://www.emptiedout.com


More information about the PLUG-discuss mailing list