Probably not spoofed, I see a lot of scanning from China.
route: 121.8.0.0/13
descr: From Guangdong Network of ChinaTelecom
origin: AS4134
mnt-by: MAINT-CHINANET
changed: [EMAIL PROTECTED] 20060707
source: APNIC
person: Chinanet Hostmaster
nic-hdl: CH93-AP
e-mail: [EMAIL PROTECTED]
addr
Rich Sena wrote:
Anyone seeing anything similar - trying to determine if this is spoofed
etc...
Why would you think it is a problem? It's China Telecom. What else would you
expect?
Off the sarcastic and onto the serious, I am seeing hits on 53/UDP and 25/TCP
from a couple of hosts in tha
Rich Sena wrote:
Anyone seeing anything similar - trying to determine if this is spoofed
etc...
I haven't picked up any SSH or telnet scans from that network. That's
what I'm looking for at the moment. The amount of scans we're getting
are quite impressive at times. I wish there was an
On Wed, 5 Mar 2008, Tom Sands wrote:
When we did get a hold of someone, they mentioned they could support
simple ICMP requests.
To them "simple" means it's just a ping check. They won't
montior/graph/care about latency.
I was pondering creating a "smoke ping collective". Get a bunch of g
John A. Kilpatrick wrote:
On Wed, 5 Mar 2008, Tom Sands wrote:
When we did get a hold of someone, they mentioned they could support
simple ICMP requests.
To them "simple" means it's just a ping check. They won't
montior/graph/care about latency.
I was pondering creating a "smoke ping col
Have you queried the DShield database for the hosts you are seeing?
http://www.dshield.org/ipinfo.html?ip= add the IP after the =
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
> Behalf Of Rich Sena
> Sent: Thursday, March 06, 2008 12:02 PM
> To: NANOG
>
