nanog mailing list archives

Previous By Date Next
Previous By Thread Next

Re: Unexplainable router log entries mentioning IPSEC from Yahoo IPs

From: Adrian Minta <adrian.minta () gmail com>
Date: Fri, 18 Dec 2020 21:16:36 +0200
Yes, we saw them as well:
Dec    18    10:02:00:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.102 Dec    18    08:55:18:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.2 Dec    18    08:05:30:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.4 Dec    18    07:47:35:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.19 Dec    18    07:15:34:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.38 Dec    18    07:09:59:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.100 Dec    18    06:54:57:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.22 Dec    18    06:46:54:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.17 Dec    18    06:38:24:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.35 Dec    18    06:11:09:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.101 Dec    18    05:50:20:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.35 Dec    18    05:49:23:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.7 Dec    18    05:42:18:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.33 Dec    18    05:30:41:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.8 Dec    18    05:24:58:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.21 Dec    18    03:19:04:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.18 Dec    18    05:11:08:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.8 Dec    18    05:09:08:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.33 Dec    18    04:59:50:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.49 Dec    18    04:49:09:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.35 Dec    18    04:28:32:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.52 Dec    18    02:23:25:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.101 Dec    18    04:10:48:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.38 Dec    18    03:13:41:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.36 Dec    18    02:53:18:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.20 Dec    18    02:49:16:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.51 Dec    18    02:45:59:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=66.196.91.232 Dec    18    02:42:21:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.23 Dec    18    02:33:05:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.37 Dec    18    02:30:46:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.50 Dec    18    02:23:02:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.20 Dec    18    00:57:45:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.50 Dec    17    17:06:12:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.18 Dec    17    14:45:06.899:    %CRYPTO-4-RECVD_PKT_INV_SPI: decaps:    rec'd    IPSEC    packet    has    invalid    spi for    destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.34 Dec    17    16:38:03:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.37 Dec    17    16:28:13:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=203.84.212.40 Dec    17    16:24:06:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.99 Dec    17    15:14:03:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.40 Dec    17    15:06:40:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    srcaddr=68.180.160.100 Dec    17    08:57:00:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=68.180.160.23 Dec    17    08:25:36:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=68.180.160.104 Dec    17    08:11:54:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=68.180.160.19 Dec    17    07:22:22:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=203.84.212.55 Dec    17    06:18:55:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=68.180.160.20 Dec    17    06:14:35:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=203.84.212.36 Dec    17    06:13:05:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=203.84.212.17 Dec    17    05:36:24:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=203.84.212.53 Dec    17    01:56:17:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=68.180.160.17 Dec    17    03:27:47:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: rec'd    IPSEC    packet    has    invalid    spi    for destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    srcaddr=203.84.212.34 

--
Best regards,
Adrian Minta
Previous By Date Next
Previous By Thread Next

Current thread: