UDP echo packets from 1 dec until present

[Jose Nazario <jose () BIOCSERVER BIOC CWRU EDU>]

hi all,

i've been receiving a handful of UDP echo packets on an email server since
december 1, consistently from the same IP address. so far it hasn't caused
any performance problems (ie no floods), and they're being blocked. i'm at
a loss, though, to figure out why this trickle of packets would be found.
it does't make sense from a Firewalk point of view, as most sites block
echo (both tcp and udp) on their borders. it doesn't make sense from the
standpoint of detecting hosts, either, for that very reason. and the
trickle seems like a very poorly done DDoS, which seems to rule that out
(unless we assume super stupid attackers).

any input would be welcome. these are the only connections i have from
that IP (from xinetd logs):

00/12/1@10:44:08: FAIL: echo-dgram address from=169.254.97.28
00/12/1@11:54:48: FAIL: echo-dgram address from=169.254.97.28
00/12/1@14:59:32: FAIL: echo-dgram address from=169.254.97.28
00/12/1@15:09:58: FAIL: echo-dgram address from=169.254.97.28
00/12/1@15:54:13: FAIL: echo-dgram address from=169.254.97.28
00/12/1@16:09:54: FAIL: echo-dgram address from=169.254.97.28
00/12/1@16:54:42: FAIL: echo-dgram address from=169.254.97.28
00/12/1@18:14:09: FAIL: echo-dgram address from=169.254.97.28
00/12/2@10:13:35: FAIL: echo-dgram address from=169.254.97.28
00/12/2@10:20:29: FAIL: echo-dgram address from=169.254.97.28
00/12/2@11:37:33: FAIL: echo-dgram address from=169.254.97.28
00/12/2@16:14:34: FAIL: echo-dgram address from=169.254.97.28
00/12/2@21:03:30: FAIL: echo-dgram address from=169.254.97.28
00/12/3@15:49:36: FAIL: echo-dgram address from=169.254.97.28
00/12/4@09:07:02: FAIL: echo-dgram address from=169.254.97.28
00/12/4@09:17:13: FAIL: echo-dgram address from=169.254.97.28
00/12/4@13:41:22: FAIL: echo-dgram address from=169.254.97.28
00/12/5@08:06:59: FAIL: echo-dgram address from=169.254.97.28
00/12/5@09:55:35: FAIL: echo-dgram address from=169.254.97.28
00/12/5@11:37:08: FAIL: echo-dgram address from=169.254.97.28
00/12/5@12:25:36: FAIL: echo-dgram address from=169.254.97.28
00/12/5@13:00:57: FAIL: echo-dgram address from=169.254.97.28
00/12/5@13:15:30: FAIL: echo-dgram address from=169.254.97.28
00/12/5@15:42:36: FAIL: echo-dgram address from=169.254.97.28

____________________________
jose nazario                                                 jose () cwru edu
                     PGP: 89 B0 81 DA 5B FD 7E 00  99 C3 B2 CD 48 A0 07 80
                                       PGP key ID 0xFD37F4E5 (pgp.mit.edu)