[nsp-sec] Anyone from Cox.net on the list?

Wed Oct 8 04:07:57 EDT 2008

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Is anyone from cox.net on nsp-sec?

Could you please contact me about a continuing stream of TCP reset
packets that are being send to some of our router interface IP addresses
on port 524 (14842521 packets since start). I have tried to contact
abuse at cox.net, but got no response so far.

Originating IP appears to be 98.162.225.216

[...]
Oct  8 07:55:12 re1-jnr01.asd001a.surf.net fpc2 PFE_FW_SYSLOG_IP: %FIREWALL-6-FW: ae1.500      D  tcp 98.162.225.216 145.145.x.y 14953   524 (1 packets)
Oct  8 07:55:12 re1-jnr01.asd002a.surf.net fpc4 PFE_FW_SYSLOG_IP: %FIREWALL-6-FW: ae2.500      D  tcp 98.162.225.216 145.145.a.b 15881   524 (1 packets)
[...]

Thanks in advance,

Niels den Otter
SURFnet
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkjsal0ACgkQDxUhWEap0R4oiQCfZ0dPpYp2d6iX7IerRBHrYUNr
lZoAn3UQu2QWzatHZW/AsvX2zrZ26LeY
=tUbj
-----END PGP SIGNATURE-----