Odd snmp scans from 10.0.0.0/8 address ???

[r.fulton () AUCKLAND AC NZ (Russell Fulton)]

A few days ago we saw a series of scans that varied the 3rd octect of
the IP address (see argus logs below).  These scans appeared to be part
of a much wider scan perhaps all of 130/8 as the scans repeated every
couple of hours with a new final octet.

Sample argus logs:

23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.198.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.202.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.204.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.206.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.207.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.209.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.212.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.213.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.211.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.214.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.216.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.215.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.217.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.218.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.219.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.223.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.220.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.227.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.221.28.161   TIM
23 Apr 00 19:14:45      udp      10.2.16.76.2846   ->  130.216.231.28.161   TIM

as you can see they are scanning address 28 in each class C net

We saw similiar scans at
 2000.04.24:07.11
 2000.04.24:05.28
 2000.04.24:03.46
 2000.04.24:02.04
 2000.04.24:00.21
 2000.04.23:22.39
 2000.04.23:20.57

Each time scanning a new address in each subnet.

I have seen such scans before and I think nmap has an option for doing
just this so no mystery there but what puzzles me is the source
address which is in the range reserved for multicast.

Is there anyway anyone could get useful information from this scan?

BTW times are UTC +1200 our class B is 130.216/16

Cheers, Russell.