[nsp] 127.0.0.0/8 unroutable?

[Iva Cabric]

On Tue, Nov 11, 2003 at 10:05:04PM +0100, Gert Doering wrote:
> 
> Don't tell me about it...
> 
> Nov  9 21:24:48 cisco1 73286: %SEC-6-IPACCESSLOGP: list 110 denied tcp 127.0.0.1(80) (FastEthernet0/0 0005.9af9.b008) -> 80.81.193.105(1159), 1 packet
> Nov  9 21:33:06 cisco2 55379: %SEC-6-IPACCESSLOGP: list 110 denied tcp 127.0.0.1(80) (FastEthernet0/0 0090.69b1.7c1f) -> 80.81.192.105(1604), 1 packet
> Nov  9 21:47:12 cisco1 73332: %SEC-6-IPACCESSLOGP: list 110 denied tcp 127.0.0.1(80) (FastEthernet0/0 0090.69b1.7c1f) -> 80.81.193.105(1334), 1 packet
> 
> (this is 12.2S, which seems to log these packets in a perfectly normal
> fashion - the weird ACL logging was in 12.0 or so).
> 
> I'm not sure which kind of virus/worm/garbage software is creating these
> packets, but it's always an experience to talk to your peers/upstream and
> have them filter these packets...

I've noticed same traffic, it seems that cause of problem is MSBlaster,
more details in this thread:

http://cert.uni-stuttgart.de/archive/intrusions/2003/08/msg00209.html