Educause Security Discussion mailing list archives

ngrep question


From: Scott Weeks <sweeks () SANDIEGO EDU>
Date: Mon, 17 May 2004 15:18:00 -0700

Hello Everyone,

I have a curious question for those of you that use ngrep
(http://sourceforge.net/projects/ngrep/).  I see strange IP addresses (see
below) and was wondering if any of you had seen these reserved IP
addresses on your networks.

     T 175.157.10.10 -> 102.211.0.0 +1540@8:46
     T  97.176.10.10 -> 103.255.0.0 +1540@8:46
     T   90.68.10.10 -> 103.233.0.0 +1540@8:46
     T 175.157.10.10 -> 102.211.0.0 +1540@8:46
     T 143.226.10.10 -> 3.82.0.0    +1540@8:46

I am having trouble finding anything on the web.  The only correlation I
see is they all seem to have "+1540@8:46" and the last two octets of the
sender are x.x.10.10 and the last two octets of the receiver are x.x.0.0

Just in case any of you folks are RGNs (Real Good Netgeeks :) I have put
an entire packet at the bottom of this email...

Thanks!
scott





T 143.226.10.10 -> 3.82.0.0 +1540@8:46

 
.05.p[.k+...fJ....f...P.0.=..z.W;..Y.k...".n..F...b..tb..2..v.........*.U......J.Q..*=>...6ymp....`..S...bd..~....T..o...O.m..&^.:9<pu....

i.."...{.f..U..|..})...(.....P..b...G[*fMd.mU.r.7.@.^R.q........a...8.&..&.B...F......(.U..s.............L.N.a.L.!.........a>o..%%..bxC...

.$I..&..FJR..eS.Z&3...]7r.yT.R..c..ay.....4\\a..N....Y..V:.c..w.L._l.)L.......W]..u...?Z..~..w..Y....V.....`B..#........xa....^28.x\..\..g

....*?T.V..Y;..1..)'K..._:..%...dP.8".G..hL..D/..i~..2.>v....Sh....QEC.......[L.ee\.).......$..d1`...,.V.G.."@....gL...R....?....$.....h..

.,b.;..3J......!.b...z=...Evy..{v.U.......I]....!.'..5.c$b-0.DD.H2C@R2..Z....^.......
v}...P.."........Z..6..-...o...0Z?...31.....7..9A..

....3...-DD5l........&..........H]..es............b....O..../....P...!S.r2?.3........m"..)....<e..,].`J...1..^.e....4.I.&@,..
.f.T.R$.....
  ...3..D
.....i...T.e...Z..........t...9..A....3...C...o.@....p.........^y..\...0.x.../..9h...$x.......]N.a.\..B.....h....J..@1.@..*....qS.

.........i.P.C.).LY.{.T....;.y..=...2...)D"..,...\kjP\^..B\....).2...'.-.-u.h.(~.......]N.ac\..6.....V....LQt[B......T. 
()   Y    kUY..K...m.
  ......eQ0b...U.N..
.-qkNS.(...r..C...P.:....n.W;.d...).RT..A.c....?.U.d.....n..jZ'....a%.Y9.B..GM...2.91H...f....~..=.........E..|o....RV.

....X..,..4w[M=...........3.|B..5.C$x....]Gw.............eYN.a.\.rv.....}.......gUq.IJ.N.0.L...
.<,..<PX](.V.....*b)-..Rm.N..b.......9.QN.

.k.cU.Y.!hv..T.2.us......Y......,...].i..P...].".c+.....R.....l....%O..!....l.......B.r.^Z.R/.^.h./fsm.},.r...h.~......G".\.!...G.q.:....)

)..-H.7#X..Xg.c2.4....L.z*4...{............;R.a.\.rz.........R....Q.=.k..KU..4@....c...{...-K......?.M.....[.}..g.2.zf..R.:.K1f..(..;P..S}
  .r.f.UM.'.5#'*............d.m...}..w.k~........sR5}E.....t1.y$".YK5.

..._..X..bd)O%(..u.Y~,..b...3#...........G.."..,...,<H.b^.6T...Bm=*.I!.C%mi......Eo.h.T[J........i[R.a.\.A....L.....d$@.&.`$..0../!Nm@.:.;

4d.G6.C...SA.......7....7?.......H.N.....?,....2s........a..G.d....,.../...(}.F...dY.....jQ`
`..5...mbB..z.y^.TO.D......+j..s.].I.J

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.

Current thread: