[21473] in North American Network Operators' Group
Re: Exodus / Clue problems
daemon@ATHENA.MIT.EDU (TTSG)
Sun Nov 15 22:01:32 1998
From: TTSG <ttsg@ttsg.com>
To: list@inet-access.net
Date: Sun, 15 Nov 1998 21:41:28 -0500 (EST)
Cc: nanog@merit.edu
In-Reply-To: <19981115182201.A9722@cmc.net> from "brian moore" at Nov 15, 98 06:22:01 pm
>
> On Sun, Nov 15, 1998 at 06:24:13PM -0500, sigma@pair.com wrote:
> >
> > Let me guess - the IP is 209.67.50.254, and they're trying to login to
> > nameservers as "root", sometimes a dozen times per second?
>
> Not seeing that rate, but yep:
> Nov 15 18:10:25 mailhost.cmc.net ipmon[117]: 18:10:24.956040 le0 @35 b
> 209.67.50.254,1608 -> mailhost.cmc.net,telnet PR tcp len 20 44 -S
>
Possible to do some TCPDUMPs????? Can you decode the packets
and see if there is any source routing or something funny occurring?
Tuc/TTSG
