hits from reserved IPs

Eyal Lebedinsky eyal at eyal.emu.id.au
Sat May 18 20:26:26 EST 2002


I have a Q about Telstra ADSL.

Today (18May02) I got a whole flood of hits from these addresses:
	172.16.0.*:80
	10.10.2.101-112:80
	10.30.1.102:80
all to high ports on my IP.

The event lasted from 12:23:08 till 12:36:27. There were 365 hits.

I wonder it this could have come from outside the Telstra network
(I am on Telstra ADSL) since these IPs are not routed?

Could it come from another Telstra ADSL customer?

My Qs are about how the network is configured, not about the specific
incident (all my ports are closed and everything was DENYed by my fw).

But also, is there a known issue with connections to high ports? Maybe
a known problem with NAT? My fw is an old 2.2 w/ipchains so any newer
vulnerabilities will probably be missing. I recently read
	http://rhn.redhat.com/errata/RHSA-2002-086.html
which may be related.

--
Eyal Lebedinsky (eyal at eyal.emu.id.au) <http://samba.org/eyal/>




More information about the linux mailing list