Security Incidents mailing list archives

Re: What a strange route (The DoD inside)!


From: "Jean-Marc Soumet" <Jean-Marc.Soumet () nsc com>
Date: Tue, 04 Apr 2006 12:16:26 -0700

Pieter de Boer wrote:
dave wrote:

11  26.26.26.xx (26.26.26.xx)  4.462 ms  3.674 ms  3.644 ms
12  26.26.26.xxx (26.26.26.xxx)  5.055 ms  3.834 ms  3.797 ms
13  26.26.26.xxx (26.26.26.xxx)  5.112 ms  3.541 ms  3.816 ms
    DoD Network Information Center <- Why?

Sometimes people just assign themselves some IP address space, not via RIPE/ARIN/APNIC/etc, but just picking a address randomly. The range 26.26.26.xx looks like such an 'assignment'.

Of course, it's bad habit to just pick a random address and use it inside your network, but it happens a lot, especially with rcf1918 space. It also happens a lot that those addresses can be seen by tracerouting..

Hope this clears things up a bit,
Pieter


As Pieter said this ISP must be using DOD IP addresses on their internal network. Unless they have a special link that transmits data directly from Italy to Columbus, Ohio and back to Italy, in 1ms round trip. ^_^
I don't think this could be associated with Dave's incident.

Regards,

Jean-Marc
_____________________
Jean-Marc Soumet
Information Security Analyst
National Semiconductor
+1-408-721-2131



Current thread: