[138453] in North American Network Operators' Group
RE: [arin-ppml] why hp bladeserver chassis have a sudden interest
daemon@ATHENA.MIT.EDU (Smith, Donald)
Tue Mar 8 07:49:52 2011
From: "Smith, Donald" <Donald.Smith@qwest.com>
To: Joel Jaeggli <joelja@bogus.com>, NANOG <nanog@nanog.org>,
"arin-ppml@arin.net" <arin-ppml@arin.net>
Date: Tue, 8 Mar 2011 05:46:09 -0700
In-Reply-To: <4D75B373.2040506@bogus.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
http://isc.sans.edu/diary/Outbound+SSH+Traffic+from+HP+Virtual+Connect+Blad=
es/10498
It is going for a range of ips. We only see syn's never a response from the=
ips.
Netflow sampling at 1/1k results from yesterday's SSH fun:)
Countx1k ip
244 49.48.46.49
125 49.48.46.51
74 49.48.46.50
69 49.48.46.54
25 49.48.46.55
18 49.48.46.53
11 49.48.46.48
2 49.48.46.57
(coffee !=3D sleep) & (!coffee =3D=3D sleep)
Donald.Smith@qwest.com
________________________________________
From: arin-ppml-bounces@arin.net [arin-ppml-bounces@arin.net] On Behalf Of =
Joel Jaeggli [joelja@bogus.com]
Sent: Monday, March 07, 2011 9:41 PM
To: NANOG; arin-ppml@arin.net
Subject: [arin-ppml] why hp bladeserver chassis have a sudden interest in =
thailand.
http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=3D109447=
626+1299558177753+28353475&threadId=3D1471451
As a potentially cautionary tale for the squatting on unused pieces of
address space either in your network or applications.
drive slow (and filter 22 outgoing to 49.48.46.49 until you get new
firmware)
joel
_______________________________________________
PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-PPML@arin.net).
Unsubscribe or manage your mailing list subscription at:
http://lists.arin.net/mailman/listinfo/arin-ppml
Please contact info@arin.net if you experience any issues.
This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful. If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.
