Security Incidents mailing list archives

Strange ping reply packets


From: Artur.Nowak-sec-incidents () WODIP OPOLE PL (Artur Nowak)
Date: Tue, 8 Feb 2000 17:06:02 +0100


Hi all,

today I have two strange floods of pnig reply packets. I am not sure if
it's a smurf attack or something. It looks the source ip addresses are
random generated so I don't know if it's possible to find real source of
attack.
If anybody have some ideas how to find source address I will be grateful
for help.

BTW: What is usually listening on port 6700/tcp?
Feb  8 10:19:56 TCP: port 6700 connection attempt from 208.184.216.206:1526

PS. Sorry for a bit long logs.

Feb  8 10:24:25 ICMP: echo reply from 209.180.64.82 (8 bytes)
Feb  8 10:24:25 ICMP: echo reply from 149.159.75.47 (8 bytes)
Feb  8 10:24:25 ICMP: echo reply from 212.151.36.6 (8 bytes)
Feb  8 10:24:25 ICMP: echo reply from 128.255.178.104 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 204.210.11.15 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 161.112.116.112 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 149.159.94.109 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 24.25.65.32 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 204.101.60.77 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 128.210.131.189 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 129.82.96.191 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 198.68.218.53 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 194.47.110.90 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 209.166.140.96 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 212.204.129.15 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 216.63.188.108 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 24.67.11.14 (8 bytes)
Feb  8 10:24:26 ICMP: echo reply from 206.243.152.214 (8 bytes)
Feb  8 10:24:27 ICMP: echo reply from 24.11.152.7 (8 bytes)
Feb  8 10:24:27 ICMP: echo reply from 144.126.186.243 (8 bytes)
Feb  8 10:24:27 ICMP: echo reply from 149.159.36.200 (8 bytes)
Feb  8 10:24:28 ICMP: echo reply from 203.134.57.37 (8 bytes)
Feb  8 10:24:29 ICMP: echo reply from 169.233.40.53 (8 bytes)
Feb  8 10:30:34 ICMP: echo reply from 208.20.66.75 (8 bytes)
Feb  8 10:30:34 ICMP: echo reply from 216.209.208.68 (8 bytes)
Feb  8 10:30:35 ICMP: echo reply from 24.200.85.233 (8 bytes)
Feb  8 10:30:35 ICMP: echo reply from 134.173.164.10 (8 bytes)
Feb  8 10:30:35 ICMP: echo reply from 24.17.32.34 (8 bytes)
Feb  8 10:30:35 ICMP: echo reply from 63.28.12.139 (8 bytes)
Feb  8 10:30:36 ICMP: echo reply from 212.151.36.6 (8 bytes)
Feb  8 10:30:36 ICMP: echo reply from 192.200.134.111 (8 bytes)
Feb  8 10:30:36 ICMP: echo reply from 131.118.92.173 (8 bytes)
Feb  8 10:30:36 ICMP: echo reply from 209.149.49.86 (8 bytes)
Feb  8 10:30:36 ICMP: echo reply from 216.209.157.141 (8 bytes)
Feb  8 10:30:37 ICMP: echo reply from 209.198.205.94 (8 bytes)
Feb  8 10:30:37 ICMP: echo reply from 216.122.92.141 (8 bytes)
Feb  8 10:30:37 ICMP: echo reply from 155.198.180.220 (8 bytes)
Feb  8 10:30:37 ICMP: echo reply from 128.210.131.189 (8 bytes)
Feb  8 10:30:37 ICMP: echo reply from 148.233.90.163 (8 bytes)
Feb  8 10:30:37 ICMP: echo reply from 203.134.57.37 (8 bytes)
Feb  8 10:30:37 ICMP: echo reply from 24.6.159.124 (8 bytes)
Feb  8 10:30:38 ICMP: echo reply from 129.82.96.191 (8 bytes)
Feb  8 10:30:38 ICMP: echo reply from 24.7.220.199 (8 bytes)
Feb  8 10:30:38 ICMP: echo reply from 151.21.153.30 (8 bytes)
Feb  8 10:30:39 ICMP: echo reply from 209.166.140.96 (8 bytes)
Feb  8 10:30:40 ICMP: echo reply from 24.26.67.8 (8 bytes)
Feb  8 10:30:40 ICMP: echo reply from 213.46.17.189 (8 bytes)
Feb  8 10:30:41 ICMP: echo reply from 62.20.249.113 (8 bytes)
Feb  8 10:30:43 ICMP: echo reply from 4.54.85.92 (8 bytes)

--
 Artur Nowak       ==> mail anowak-pgp () wodip opole pl for PGP pub_key
  e-mail : anowak () wodip opole pl       || anowak () polo po opole pl
  www    : www.wodip.opole.pl/~anowak/ || polo.po.opole.pl/~anowak/
 PGP: 0x7BCE3064 | CF14 7AF4 2A1B 485E B0B5 1261 F7A1 26D5 7BCE 3064



Current thread: