[nsp-sec] Full class B scan from 128.0.22.85

[Joel Rosenblatt]

Hi,

We know it's coming from the outside (it's from flows to our border routers) .. I'll look at BGPlay and see what I can find out.

Thanks,
Joel

--On Monday, April 27, 2009 9:42 AM -0400 Jon Lewis <jlewis at lewis.org> wrote:

> On Mon, 27 Apr 2009, Joel Rosenblatt wrote:
>
>> ----------- nsp-security Confidential --------
>>
>> Hi,
>>
>> Any ideas who I can contact about this?
>>
>> 25-Apr-2009 04:37:10 GMT-0400 128.0.22.85:1157 -> 128.59.0.2:445 6 48
>> 25-Apr-2009 04:37:10 GMT-0400 128.0.22.85:1158 -> 128.59.0.3:445 6 48
>> 25-Apr-2009 04:37:10 GMT-0400 128.0.22.85:1162 -> 128.59.0.7:445 6 48
>
># sh ip bg 128.0.22.85
> % Network not in table
>
> Since it's IANA reserved space, look internally or use one of the BGPlay
> things to see if anyone actually was announcing the space on the 25th.
>
> ----------------------------------------------------------------------
>   Jon Lewis                   |  I route
>   Senior Network Engineer     |  therefore you are
>   Atlantic Net                |
> _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
>



Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel