[101335] in North American Network Operators' Group
Re: DreamHost Contact?
daemon@ATHENA.MIT.EDU (Robert E. Seastrom)
Mon Dec 31 04:13:19 2007
To: Gregory Hicks <ghicks@cadence.com>
Cc: nanog@merit.edu, mgreb@linode.com
From: "Robert E. Seastrom" <rs@seastrom.com>
Date: Mon, 31 Dec 2007 04:12:28 -0500
In-Reply-To: <200712310427.lBV4R2s4004131@mailhub.Cadence.COM> (Gregory Hicks's message of "Sun, 30 Dec 2007 20:27:02 -0800 (PST)")
Errors-To: owner-nanog@merit.edu
Gregory Hicks <ghicks@cadence.com> writes:
>> Date: Sun, 30 Dec 2007 21:42:21 -0500
>> From: Michael Greb <mgreb@linode.com>
>>
>> I've got a user sending a lot of UDP traffic to 208.113.189.13 port 22.
>> This traffic is very likely undesirable and I'd be willing to pull the
>> plug immediately if I can get confirmation from DreamHost. Failing that
>
> Port 22? Isn't that ssh? Doesn't ssh have the capability to forward X or
> whatever via ssh?
I'm with Gregory here. Between scp and port forwarding, there are
plenty of explanations for lots of traffic on port 22. What exactly
leads you to the conclusion that the traffic is "very likely
undesirable"?
---rob
