[nsp-sec] 15 Gbps TCP SYN DoS
Mike Tancsa
mike at sentex.net
Sat Apr 20 08:46:59 EDT 2013
On 4/20/2013 2:27 AM, Jason Chambers wrote:
> ----------- nsp-security Confidential --------
>
> Hello all,
>
> Earlier today during lunchtime we experienced a 15 Gbps DoS attack
> directed towards 128.97.25.146.
>
> The traffic was SYN flood to TCP/80. This server wasn't running an
> official web server so consider any traffic towards that IP/Port as
> suspect.
>
> If you find anything interesting we'd appreciate hearing it.
>
> Start: 2013/04/19T18:50:00
> Stop: 2013/04/19T19:50:00 (null routed)
I saw a lot of backscatter to random addrs in my AS. I guess the
attacker just spoofed the addresses
---Mike
--
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike at sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada http://www.tancsa.com/
-------------- next part --------------
StartTime Flgs Proto SrcAddr Sport Dir DstAddr Dport TotPkts TotBytes State
13:17:14.789065 e tcp 128.97.25.146.80 ?> 67.43.143.114.43408 1 60 RA_
13:17:31.097062 e tcp 128.97.25.146.80 ?> 64.7.129.90.28631 1 60 RA_
13:18:00.660000 Ne tcp 128.97.25.146.80 ?> 199.85.119.113.21416 1 40 RA_
13:08:31.087687 e tcp 128.97.25.146.80 ?> 98.159.250.8.15862 1 60 RA_
13:19:32.820700 e s tcp 128.97.25.146.22 ?> 67.43.143.114.43408 2 120 SA_
13:19:35.292442 e tcp 128.97.25.146.22 ?> 67.43.143.120.52872 1 60 SA_
13:19:48.741421 e tcp 128.97.25.146.22 ?> 64.7.129.90.28631 1 60 SA_
13:21:29.607676 e tcp 128.97.25.146.22 ?> 64.7.136.73.28358 1 60 SA_
13:21:28.548000 Ne tcp 128.97.25.146.22 -> 98.159.244.48.1214 1 44 SA_
13:21:43.094000 Ne tcp 128.97.25.146.22 -> 206.130.91.102.49939 1 44 SA_
13:22:03.134525 e tcp 128.97.25.146.22 ?> 67.43.135.34.52360 1 60 SA_
13:21:52.284000 Ne tcp 128.97.25.146.22 -> 199.71.252.8.21119 1 44 SA_
13:22:16.529000 Ne tcp 128.97.25.146.22 -> 199.85.119.76.18516 1 44 SA_
14:07:28.165000 Ne tcp 128.97.25.146.80 ?> 67.43.133.25.64161 1 40 RA_
14:07:37.878000 Ne tcp 128.97.25.146.80 ?> 67.43.133.25.64161 1 40 RA_
14:08:29.482000 Ne tcp 128.97.25.146.80 ?> 206.130.91.102.49939 1 40 RA_
14:08:43.551000 Ne tcp 128.97.25.146.80 ?> 199.71.252.8.21119 1 40 RA_
14:08:45.980970 e tcp 128.97.25.146.80 ?> 64.7.151.119.21329 1 60 RA_
14:09:15.002199 e tcp 128.97.25.146.80 ?> 67.43.135.34.52360 1 60 RA_
14:10:01.084000 Ne tcp 128.97.25.146.80 ?> 199.85.119.28.41684 1 40 RA_
14:10:26.626520 M tcp 128.97.25.146.80 ?> 64.7.143.107.64011 2 122 RA_
14:10:44.337000 Ne tcp 128.97.25.146.80 ?> 199.85.118.84.13156 1 40 RA_
14:11:08.013101 e tcp 128.97.25.146.80 ?> 98.159.254.11.44185 1 60 RA_
14:11:26.109000 Ne tcp 128.97.25.146.80 ?> 64.7.147.7.41537 1 40 RA_
14:11:30.640881 e tcp 128.97.25.146.80 ?> 98.159.255.9.17260 1 60 RA_
14:12:12.372000 Ne tcp 128.97.25.146.80 ?> 64.7.154.81.45436 1 40 RA_
14:12:15.344000 Ne tcp 128.97.25.146.80 ?> 198.73.240.106.60206 1 40 RA_
14:12:33.122000 Ne tcp 128.97.25.146.80 ?> 67.43.136.70.47474 1 40 RA_
14:14:34.726202 e tcp 128.97.25.146.80 ?> 64.7.157.79.47910 1 60 RA_
14:16:03.761570 e tcp 128.97.25.146.80 ?> 67.43.142.120.44358 1 60 RA_
14:16:12.394000 Ne tcp 128.97.25.146.80 ?> 199.85.118.67.54457 1 40 RA_
14:16:22.210000 Ne tcp 128.97.25.146.80 ?> 64.7.154.61.35362 1 40 RA_
14:16:46.074000 Ne tcp 128.97.25.146.80 ?> 206.130.91.17.41017 1 40 RA_
14:16:54.999000 Ne tcp 128.97.25.146.80 ?> 64.7.147.25.27257 1 40 RA_
14:17:27.940335 e tcp 128.97.25.146.80 ?> 64.7.156.25.8458 1 60 RA_
14:17:38.370768 e tcp 128.97.25.146.80 ?> 67.43.142.9.51769 1 60 RA_
14:17:45.704000 Ne tcp 128.97.25.146.80 ?> 64.7.147.62.43846 1 40 RA_
14:17:48.570000 Ne tcp 128.97.25.146.80 ?> 206.130.91.17.41017 1 40 RA_
14:18:32.631000 Ne tcp 128.97.25.146.80 ?> 206.130.91.76.34433 1 40 RA_
14:18:35.369588 * tcp 128.97.25.146.80 ?> 64.7.140.75.63358 1 58 RA_
14:18:35.369582 * tcp 128.97.25.146.80 ?> 64.7.140.75.63358 1 60 RA_
14:18:43.043000 Ne tcp 128.97.25.146.80 ?> 206.130.91.70.6425 1 40 RA_
14:19:23.243000 Ne tcp 128.97.25.146.80 ?> 206.130.91.124.45742 1 40 RA_
14:19:51.335096 e tcp 128.97.25.146.80 ?> 64.7.151.72.3059 1 60 RA_
14:20:17.800000 Ne tcp 128.97.25.146.80 ?> 204.138.108.38.8777 1 40 RA_
14:21:08.459000 Ne tcp 128.97.25.146.80 ?> 67.43.136.10.26912 1 40 RA_
14:21:34.696000 Ne tcp 128.97.25.146.80 ?> 199.85.118.92.61706 1 40 RA_
14:21:59.096000 Ne tcp 128.97.25.146.80 ?> 67.43.133.98.47438 1 40 RA_
14:22:27.136000 Ne tcp 128.97.25.146.80 ?> 67.43.133.63.43741 1 40 RA_
14:22:30.660000 Ne tcp 128.97.25.146.80 ?> 98.159.244.66.23197 1 40 RA_
14:22:33.669000 Ne tcp 128.97.25.146.80 ?> 64.7.154.109.5063 1 40 RA_
14:23:10.009000 Ne tcp 128.97.25.146.80 ?> 204.138.108.52.384 1 40 RA_
14:24:53.710000 Ne tcp 128.97.25.146.80 ?> 198.73.240.46.64451 1 40 RA_
14:26:38.829047 M tcp 128.97.25.146.80 ?> 64.7.149.50.37095 2 122 RA_
14:27:42.430000 Ne tcp 128.97.25.146.80 ?> 199.85.118.112.26119 1 40 RA_
14:27:43.195000 Ne tcp 128.97.25.146.80 ?> 64.7.154.94.21722 1 40 RA_
14:29:28.099000 Ne tcp 128.97.25.146.80 ?> 199.71.252.82.13706 1 40 RA_
14:29:51.432000 Ne tcp 128.97.25.146.80 ?> 199.85.118.36.41295 1 40 RA_
14:31:03.291765 e tcp 128.97.25.146.80 ?> 64.7.134.82.36051 1 60 RA_
14:31:10.117000 Ne tcp 128.97.25.146.80 ?> 64.7.147.32.16294 1 40 RA_
14:31:19.438790 e tcp 128.97.25.146.80 ?> 64.7.156.66.3123 1 60 RA_
14:31:41.654146 e tcp 128.97.25.146.80 ?> 98.159.254.112.65211 1 60 RA_
14:31:55.485486 e tcp 128.97.25.146.80 ?> 67.43.143.110.19147 1 60 RA_
14:32:02.581348 M tcp 128.97.25.146.80 ?> 198.235.181.103.8718 2 122 RA_
14:32:20.887083 e tcp 128.97.25.146.80 ?> 98.159.254.80.1137 1 60 RA_
14:32:36.282311 e tcp 128.97.25.146.80 ?> 67.43.135.89.52284 1 60 RA_
14:32:47.292344 e tcp 128.97.25.146.80 ?> 64.7.156.51.54514 1 60 RA_
14:32:50.245557 e tcp 128.97.25.146.80 ?> 64.7.157.14.1860 1 60 RA_
14:23:23.326942 e tcp 128.97.25.146.80 ?> 64.7.143.124.14173 1 60 RA_
14:33:07.787709 e tcp 128.97.25.146.80 ?> 67.43.143.98.60526 1 60 RA_
14:33:10.051000 Ne tcp 128.97.25.146.80 ?> 199.85.119.107.13758 1 40 RA_
14:33:39.262367 e tcp 128.97.25.146.80 ?> 67.43.135.51.19293 1 60 RA_
14:33:54.331991 MU tcp 128.97.25.146.80 ?> 198.235.180.65.30050 2 122 RA_
14:33:54.337898 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
14:34:12.368000 Ne tcp 128.97.25.146.80 ?> 199.71.252.30.37837 1 40 RA_
14:34:16.926000 Ne tcp 128.97.25.146.80 ?> 204.138.108.74.11410 1 40 RA_
14:34:48.317000 Ne tcp 128.97.25.146.80 ?> 199.71.252.41.1309 1 40 RA_
14:34:56.433000 Ne tcp 128.97.25.146.80 ?> 67.43.136.127.38383 1 40 RA_
14:35:38.720375 e tcp 128.97.25.146.80 ?> 98.159.254.2.42144 1 60 RA_
14:35:46.826000 Ne tcp 128.97.25.146.80 ?> 64.7.147.91.37084 1 40 RA_
14:35:58.339353 M tcp 128.97.25.146.80 ?> 98.159.240.78.19148 2 122 RA_
14:36:07.446728 e tcp 128.97.25.146.80 ?> 98.159.254.94.23788 1 60 RA_
14:36:27.434000 Ne tcp 128.97.25.146.80 ?> 67.43.133.3.35676 1 40 RA_
14:36:31.139000 Ne tcp 128.97.25.146.80 ?> 67.43.140.79.16527 1 40 RA_
14:26:53.530730 e tcp 128.97.25.146.80 ?> 98.159.250.80.36405 1 60 RA_
14:36:42.039000 Ne tcp 128.97.25.146.80 ?> 67.43.136.99.62167 1 40 RA_
14:36:50.790210 e tcp 128.97.25.146.80 ?> 98.159.245.89.28489 1 60 RA_
14:36:54.939582 e tcp 128.97.25.146.80 ?> 64.7.156.18.38780 1 60 RA_
14:36:54.959000 Ne tcp 128.97.25.146.80 ?> 67.43.137.109.58490 1 40 RA_
14:36:58.119000 Ne tcp 128.97.25.146.80 ?> 64.7.147.10.58268 1 40 RA_
14:37:23.399000 Ne tcp 128.97.25.146.80 ?> 64.7.147.10.58268 1 40 RA_
14:37:27.979165 M tcp 128.97.25.146.80 ?> 198.235.181.76.25865 2 122 RA_
14:38:09.595053 e tcp 128.97.25.146.80 ?> 64.7.136.73.50402 1 60 RA_
14:38:20.623741 e tcp 128.97.25.146.80 ?> 64.7.151.25.3437 1 60 RA_
14:38:51.051120 e tcp 128.97.25.146.80 ?> 64.7.151.104.21738 1 60 RA_
14:38:56.176101 e tcp 128.97.25.146.80 ?> 67.43.142.51.44551 1 60 RA_
14:38:58.737433 e tcp 128.97.25.146.80 ?> 64.7.151.46.13816 1 60 RA_
14:39:23.372893 e tcp 128.97.25.146.80 ?> 64.7.151.104.21738 1 60 RA_
14:39:30.324000 Ne tcp 128.97.25.146.80 ?> 64.7.154.13.54113 1 40 RA_
14:39:32.509000 Ne tcp 128.97.25.146.80 ?> 67.43.133.82.33708 1 40 RA_
14:40:04.320934 e tcp 128.97.25.146.80 ?> 67.43.142.101.55963 1 60 RA_
14:40:32.915685 M tcp 128.97.25.146.80 ?> 198.235.181.94.23746 2 122 RA_
14:40:50.979000 Ne tcp 128.97.25.146.80 ?> 64.7.147.12.39802 1 40 RA_
14:41:09.430151 e tcp 128.97.25.146.80 ?> 64.7.156.53.64996 1 60 RA_
14:41:32.247572 e tcp 128.97.25.146.80 ?> 64.7.157.101.20621 1 60 RA_
14:32:04.800338 e tcp 128.97.25.146.80 ?> 98.159.250.43.55260 1 60 RA_
14:41:54.494149 e tcp 128.97.25.146.80 ?> 64.7.157.54.1240 1 60 RA_
14:42:12.546731 e tcp 128.97.25.146.80 ?> 98.159.240.3.39149 1 60 RA_
14:44:08.082000 Ne tcp 128.97.25.146.80 ?> 199.85.118.7.32963 1 40 RA_
14:44:20.906289 M tcp 128.97.25.146.80 ?> 67.43.128.116.2784 2 122 RA_
14:45:28.187000 Ne tcp 128.97.25.146.80 ?> 67.43.133.126.35438 1 40 RA_
14:45:31.798333 M tcp 128.97.25.146.80 ?> 67.43.128.116.2784 2 122 RA_
14:45:47.473808 e tcp 128.97.25.146.80 ?> 64.7.157.67.4635 1 60 RA_
14:46:31.029594 e tcp 128.97.25.146.80 ?> 67.43.142.62.24306 1 60 RA_
14:47:06.833078 e tcp 128.97.25.146.80 ?> 64.7.157.67.4635 1 60 RA_
14:47:42.145240 e tcp 128.97.25.146.80 ?> 64.7.151.61.61693 1 60 RA_
14:48:00.254831 e tcp 128.97.25.146.80 ?> 64.7.156.16.34817 1 60 RA_
14:49:09.208936 e tcp 128.97.25.146.80 ?> 98.159.245.75.23368 1 60 RA_
14:50:13.721000 Ne tcp 128.97.25.146.80 ?> 204.138.108.21.30118 1 40 RA_
14:50:59.209816 e tcp 128.97.25.146.80 ?> 67.43.135.116.50050 1 60 RA_
14:51:15.655958 e tcp 128.97.25.146.80 ?> 98.159.245.76.32158 1 60 RA_
14:51:24.953000 Ne tcp 128.97.25.146.80 ?> 67.43.136.19.56389 1 40 RA_
14:51:24.388806 e tcp 128.97.25.146.80 ?> 64.7.156.54.60115 1 60 RA_
14:51:26.432242 e tcp 128.97.25.146.80 ?> 98.159.245.4.33579 1 60 RA_
14:51:38.007827 e tcp 128.97.25.146.80 ?> 67.43.143.53.47086 1 60 RA_
14:51:51.852437 MU tcp 128.97.25.146.80 ?> 198.235.182.84.1284 2 122 RA_
14:51:51.858515 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
14:52:34.814000 Ne tcp 128.97.25.146.80 ?> 206.130.91.106.64897 1 40 RA_
14:43:19.223237 e tcp 128.97.25.146.80 ?> 98.159.250.62.22171 1 60 RA_
14:53:10.338434 M tcp 128.97.25.146.80 ?> 198.235.180.50.30360 2 122 RA_
14:53:48.384000 Ne tcp 128.97.25.146.80 ?> 199.85.118.79.44324 1 40 RA_
14:56:06.123000 Ne tcp 128.97.25.146.80 ?> 198.73.240.111.49017 1 40 RA_
14:56:39.633416 e tcp 128.97.25.146.80 ?> 64.7.157.97.54593 1 60 RA_
14:56:44.026507 e tcp 128.97.25.146.80 ?> 67.43.143.47.30757 1 60 RA_
14:56:46.671000 Ne tcp 128.97.25.146.80 ?> 64.7.147.50.55521 1 40 RA_
14:57:14.961721 MU tcp 128.97.25.146.80 ?> 198.235.180.50.30360 2 122 RA_
14:57:14.967720 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
14:57:43.012163 e tcp 128.97.25.146.80 ?> 67.43.143.64.45229 1 60 RA_
14:57:53.224000 Ne tcp 128.97.25.146.80 ?> 206.51.24.74.23925 1 40 RA_
14:58:20.665999 e tcp 128.97.25.146.80 ?> 64.7.156.26.29738 1 60 RA_
14:58:24.676059 e tcp 128.97.25.146.80 ?> 98.159.255.62.61200 1 60 RA_
14:58:40.616000 Ne tcp 128.97.25.146.80 ?> 206.51.24.79.3619 1 40 RA_
14:59:09.417000 Ne tcp 128.97.25.146.80 ?> 67.43.140.86.27811 1 40 RA_
14:59:50.685000 Ne tcp 128.97.25.146.80 ?> 204.138.108.50.13722 1 40 RA_
14:59:56.397510 e tcp 128.97.25.146.80 ?> 98.159.254.3.34833 1 60 RA_
15:00:18.439970 e tcp 128.97.25.146.80 ?> 98.159.245.28.26192 1 60 RA_
15:00:46.455290 e tcp 128.97.25.146.80 ?> 67.43.135.69.53510 1 60 RA_
15:00:52.009758 MU tcp 128.97.25.146.80 ?> 198.235.180.42.6238 2 122 RA_
15:00:52.015732 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
15:01:02.727000 Ne tcp 128.97.25.146.80 ?> 64.7.147.50.55521 1 40 RA_
15:01:12.383249 * tcp 128.97.25.146.80 ?> 64.7.140.81.44861 1 60 RA_
15:01:31.170895 e tcp 128.97.25.146.80 ?> 67.43.142.78.43691 1 60 RA_
15:01:47.456000 Ne tcp 128.97.25.146.80 ?> 199.71.252.0.18538 1 40 RA_
15:02:08.263841 e tcp 128.97.25.146.80 ?> 64.7.157.120.13897 1 60 RA_
15:02:43.936101 e tcp 128.97.25.146.80 ?> 64.7.156.26.29738 1 60 RA_
14:53:15.581889 e tcp 128.97.25.146.80 ?> 98.159.250.116.15921 1 60 RA_
15:03:31.222000 Ne tcp 128.97.25.146.80 ?> 198.73.240.117.41677 1 40 RA_
15:03:42.058000 Ne tcp 128.97.25.146.80 ?> 199.85.119.120.25148 1 40 RA_
15:03:58.103000 Ne tcp 128.97.25.146.80 ?> 64.7.132.91.43152 1 40 RA_
15:05:12.191376 M tcp 128.97.25.146.80 ?> 67.43.128.85.58578 2 122 RA_
14:56:07.518480 e tcp 128.97.25.146.80 ?> 98.159.250.8.60065 1 60 RA_
15:06:07.737000 Ne tcp 128.97.25.146.80 ?> 67.43.136.119.5652 1 40 RA_
15:06:29.992000 Ne tcp 128.97.25.146.80 ?> 206.51.24.103.24433 1 40 RA_
15:06:33.445000 Ne tcp 128.97.25.146.80 ?> 199.85.119.109.10454 1 40 RA_
15:06:36.952000 Ne tcp 128.97.25.146.80 ?> 64.7.154.76.51735 1 40 RA_
15:06:40.394897 e tcp 128.97.25.146.80 ?> 98.159.254.72.64615 1 60 RA_
14:57:07.827595 e tcp 128.97.25.146.80 ?> 98.159.250.16.1804 1 60 RA_
15:06:55.489104 e tcp 128.97.25.146.80 ?> 67.43.142.95.13552 1 60 RA_
15:07:42.242000 Ne tcp 128.97.25.146.80 ?> 64.7.147.44.35607 1 40 RA_
15:08:25.531000 Ne tcp 128.97.25.146.80 ?> 199.85.119.41.1755 1 40 RA_
15:10:43.006000 Ne tcp 128.97.25.146.80 ?> 204.138.108.8.41181 1 40 RA_
15:11:00.028129 e tcp 128.97.25.146.80 ?> 98.159.245.40.557 1 60 RA_
15:11:02.602524 e tcp 128.97.25.146.80 ?> 98.159.254.32.45401 1 60 RA_
15:11:52.836769 e tcp 128.97.25.146.80 ?> 98.159.255.121.37570 1 60 RA_
15:12:16.637840 e tcp 128.97.25.146.80 ?> 64.7.151.94.3141 1 60 RA_
15:12:28.417441 e tcp 128.97.25.146.80 ?> 64.7.157.78.19168 1 60 RA_
15:13:07.975678 * tcp 128.97.25.146.80 ?> 205.211.164.9.32746 1 64 RA_
15:14:17.494935 e tcp 128.97.25.146.80 ?> 98.159.255.73.63200 1 60 RA_
15:14:34.042398 e tcp 128.97.25.146.80 ?> 67.43.142.111.33614 1 60 RA_
15:15:11.456019 MU tcp 128.97.25.146.80 ?> 198.235.180.42.58253 2 122 RA_
15:15:11.462157 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
15:15:43.859556 MU tcp 128.97.25.146.80 ?> 198.235.180.91.25136 2 122 RA_
15:15:43.869620 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
15:16:11.228000 Ne tcp 128.97.25.146.80 ?> 67.43.137.114.45954 1 40 RA_
15:16:29.567691 e tcp 128.97.25.146.80 ?> 67.43.135.4.37945 1 60 RA_
15:17:14.113000 Ne tcp 128.97.25.146.80 ?> 206.130.91.97.26144 1 40 RA_
15:17:18.106000 Ne tcp 128.97.25.146.80 ?> 98.159.244.57.47676 1 40 RA_
15:17:31.011303 MU tcp 128.97.25.146.80 ?> 198.235.182.0.4422 2 122 RA_
15:17:31.017467 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
15:17:31.559000 Ne tcp 128.97.25.146.80 ?> 98.159.244.47.32866 1 40 RA_
15:17:41.804576 e tcp 128.97.25.146.80 ?> 67.43.142.3.22213 1 60 RA_
15:18:15.653194 MU tcp 128.97.25.146.80 ?> 198.235.182.60.26228 2 122 RA_
15:18:15.659259 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
15:18:22.583556 e tcp 128.97.25.146.80 ?> 64.7.156.127.64636 1 60 RA_
15:18:46.694859 e tcp 128.97.25.146.80 ?> 64.7.151.59.55065 1 60 RA_
15:20:02.118000 Ne tcp 128.97.25.146.80 ?> 67.43.140.43.59041 1 40 RA_
15:11:10.900574 e tcp 128.97.25.146.80 ?> 98.159.250.20.57774 1 60 RA_
15:21:04.918432 e tcp 128.97.25.146.80 ?> 98.159.255.59.58098 1 60 RA_
15:21:08.415968 e tcp 128.97.25.146.80 ?> 98.159.240.28.59736 1 60 RA_
15:21:15.106470 M tcp 128.97.25.146.80 ?> 67.43.131.58.9988 2 122 RA_
15:11:41.803702 e tcp 128.97.25.146.80 ?> 64.7.134.61.64843 1 60 RA_
15:21:35.999000 Ne tcp 128.97.25.146.80 ?> 67.43.133.35.18007 1 40 RA_
15:21:42.308003 MU tcp 128.97.25.146.80 ?> 198.235.180.74.4648 2 122 RA_
15:21:42.313973 M icmp 64.7.132.36.0x0d03 -> 128.97.25.146.0x0000 2 148 URFIL
15:23:49.121078 e tcp 128.97.25.146.80 ?> 64.7.151.59.55065 1 60 RA_
15:14:28.071967 e tcp 128.97.25.146.80 ?> 98.159.250.45.46949 1 60 RA_
15:30:00.648000 Ne tcp 128.97.25.146.80 ?> 199.85.118.17.65396 1 40 RA_
15:31:01.509000 Ne tcp 128.97.25.146.80 ?> 67.43.136.35.30622 1 40 RA_
15:31:23.065000 Ne tcp 128.97.25.146.80 ?> 198.73.181.33.16674 1 40 RA_
15:32:14.745041 e tcp 128.97.25.146.80 ?> 67.43.143.64.56475 1 60 RA_
15:33:30.426197 e tcp 128.97.25.146.80 ?> 64.7.151.6.37067 1 60 RA_
15:33:33.849000 Ne tcp 128.97.25.146.80 ?> 206.51.24.77.20264 1 40 RA_
15:24:50.099534 e tcp 128.97.25.146.80 ?> 67.43.130.108.59822 1 60 RA_
15:34:59.780000 Ne tcp 128.97.25.146.80 ?> 67.43.133.53.56898 1 40 RA_
15:35:16.661000 Ne tcp 128.97.25.146.80 ?> 64.7.147.70.64305 1 40 RA_
15:35:41.365000 Ne tcp 128.97.25.146.80 ?> 198.73.181.104.33452 1 40 RA_
15:36:01.119000 Ne tcp 128.97.25.146.80 ?> 67.43.140.25.10583 1 40 RA_
15:36:05.939000 Ne tcp 128.97.25.146.80 ?> 198.73.240.2.53744 1 40 RA_
15:36:30.238000 Ne tcp 128.97.25.146.80 ?> 199.71.252.111.4232 1 40 RA_
15:36:39.301139 * tcp 128.97.25.146.80 ?> 64.7.140.47.46394 1 64 RA_
15:36:50.367648 M tcp 128.97.25.146.80 ?> 198.235.181.107.12478 2 122 RA_
15:38:24.666295 M tcp 128.97.25.146.80 ?> 98.159.240.94.40898 2 122 RA_
More information about the nsp-security
mailing list