[nsp-sec] Odd traffic to 32.1.0.0/16?

Florian Weimer fweimer at bfk.de
Mon Aug 10 03:09:48 EDT 2009


Does anybody see odd traffic towards 32.1.0.0/16, perhaps to
32.1.72.96 (80/TCP) or 32.1.7.72 (25/TCP)?

These IPv4 addresses correspond to the first four octets of Google's
IPv6 web service and Germany's Freenet incoming mail relays.  I've
observed some DNS proxy mangling IPv6 addresses in this way, and I'm
wondering how widespread this phenomenon is.

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99



More information about the nsp-security mailing list