From owner-freebsd-security@FreeBSD.ORG  Thu May  6 17:39:47 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 968E016A4CE
	for <freebsd-security@freebsd.org>;
	Thu,  6 May 2004 17:39:47 -0700 (PDT)
Received: from joint.crazylogic.net (joint.crazylogic.net [66.207.217.140])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7374743D2D
	for <freebsd-security@freebsd.org>;
	Thu,  6 May 2004 17:39:45 -0700 (PDT)
	(envelope-from matt@crazylogic.net)
Received: from haklot ([66.207.217.141])
	by joint.crazylogic.net (8.12.9/8.12.9) with ESMTP id i440XLNN021506
	for <freebsd-security@freebsd.org>;
	Mon, 3 May 2004 20:33:21 -0400 (EDT)
	(envelope-from matt@crazylogic.net)
From: "Matt Gostick" <matt@crazylogic.net>
To: <freebsd-security@freebsd.org>
Date: Mon, 3 May 2004 20:33:22 -0400
Message-ID: <001001c4316f$6ab193d0$cb01a8c0@haklot>
MIME-Version: 1.0
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2616
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Content-Filtered-By: Mailman/MimeDel 2.1.1
Subject: scheduled pings
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 07 May 2004 00:39:47 -0000

Hello,
 
I have just setup some ipfw rules to checkout some traffic to one of my
boxes.  I have three servers, only one of which has weird traffic.  It
is getting ping'd on a five minute interval from approx 3 to 8 different
ip addresses within the same second.  For example:
 
May  3 20:20:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 202.160.241.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:20:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 202.160.241.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 64.35.7.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 212.162.1.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 216.74.133.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 63.218.7.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 166.90.213.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:04 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 205.158.108.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 64.35.7.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 212.162.1.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 216.74.133.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 63.218.7.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 166.90.213.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:14 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 205.158.108.194
xxx.xxx.xxx.xxx in via dc0
 
I've just started denying pings to the box...
 
What is this?
 
Matt Gostick <matt@crazylogic.net>