RE: [arin-ppml] why hp bladeserver chassis have a sudden interest in thailand.

["Smith, Donald" <Donald.Smith () qwest com>]

http://isc.sans.edu/diary/Outbound+SSH+Traffic+from+HP+Virtual+Connect+Blades/10498


It is going for a range of ips. We only see syn's never a response from the ips.
Netflow sampling at 1/1k results from yesterday's SSH fun:)

Countx1k ip
 244        49.48.46.49
 125        49.48.46.51
  74         49.48.46.50
  69         49.48.46.54
  25         49.48.46.55
  18         49.48.46.53
  11         49.48.46.48
   2          49.48.46.57



(coffee != sleep) & (!coffee == sleep)
 Donald.Smith () qwest com
________________________________________
From: arin-ppml-bounces () arin net [arin-ppml-bounces () arin net] On Behalf Of Joel Jaeggli [joelja () bogus com]
Sent: Monday, March 07, 2011 9:41 PM
To: NANOG; arin-ppml () arin net
Subject: [arin-ppml] why hp bladeserver chassis have a sudden interest in       thailand.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1299558177753+28353475&threadId=1471451

As a potentially cautionary tale for the squatting on unused pieces of
address space either in your network or applications.

drive slow (and filter 22 outgoing to  49.48.46.49 until you get new
firmware)

joel
_______________________________________________
PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-PPML () arin net).
Unsubscribe or manage your mailing list subscription at:
http://lists.arin.net/mailman/listinfo/arin-ppml
Please contact info () arin net if you experience any issues.

This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful.  If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.