strange traffic

[securitynotice () cronus cnicinc com]

Tonight at 6:04pm est, a bunch of ping packets hit my gateway from a 
variety of sources in two .  I am assuming the following:

+ this was not directed at my gateway specifically, but I am assuming that 
other computers on my ISP's network may have also been affected
+ this is not a DoS attempt, too few packets
+ because it was from sources on a bunch of different networks, the ip 
addresses here I'm assuming are compromised IP addresses

My question(s) for the group here is, what was the purpose behind this 
traffic?  It doesn't appear to be just reconnaisance gathering (this would 
be overkill).  Your insights would be appreciated...

Thanks!

Michael Webb


note: the logs have been modified changing the hostname to 'myhost' and 
the target ip  to 'www.xxx.yyy.zzz'.  
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2752 F=0x0000 T=55 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6054 F=0x0000 T=56 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27604 F=0x0000 T=54 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64177 F=0x0000 T=53 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=34747 F=0x0000 T=47 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=15194 F=0x0000 T=57 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62383 F=0x0000 T=47 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=27709 F=0x0000 T=56 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19912 F=0x0000 T=51 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19198 F=0x0000 T=55 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=36239 F=0x0000 T=50 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=62363 F=0x0000 T=46 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=53914 F=0x0000 T=50 (#1)
Dec 22 18:04:28 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65109 F=0x0000 T=57 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3076 F=0x0000 T=55 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6396 F=0x0000 T=56 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28911 F=0x0000 T=54 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=65317 F=0x0000 T=53 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=16636 F=0x0000 T=57 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35371 F=0x0000 T=47 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=28658 F=0x0000 T=56 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63011 F=0x0000 T=47 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19541 F=0x0000 T=55 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=37238 F=0x0000 T=50 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63227 F=0x0000 T=46 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=25147 F=0x0000 T=51 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=54801 F=0x0000 T=50 (#1)
Dec 22 18:04:38 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=961 F=0x0000 T=57 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.86.230:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=3359 F=0x0000 T=55 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.84.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=6739 F=0x0000 T=56 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.14.117.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=30150 F=0x0000 T=54 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.15.251.198:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=789 F=0x0000 T=53 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
65.214.50.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=35953 F=0x0000 T=47 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
198.5.148.6:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=63666 F=0x0000 T=47 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
208.185.54.14:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=18156 F=0x0000 T=57 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
64.0.96.12:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=29583 F=0x0000 T=56 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
216.73.83.10:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=19919 F=0x0000 T=55 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
204.176.88.5:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=64162 F=0x0000 T=46 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
66.28.255.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=38267 F=0x0000 T=50 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
212.62.17.145:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=26924 F=0x0000 T=51 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
213.61.6.2:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=55687 F=0x0000 T=50 (#1)
Dec 22 18:04:48 myhost kernel: Packet log: input DENY ppp0 PROTO=1 
63.218.7.130:8 www.xxx.yyy.zzz:0 L=84 S=0x00 I=2304 F=0x0000 T=57 (#1)


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com