[Snort-users] 13 instances of ping bsd

Joe Stewart jstewart at ...262...
Tue Nov 28 09:21:41 EST 2000


On Tuesday 28 November 2000 00:47, you wrote:
> hi folks, got 13 of these within millisecs of each other all different IPs
> but apparently same mac address...... none of the addresses have shown up
> before or since. any thoughts?

These are coming from Internap/pnap.net in cooperation with lots of different
backbone providers, as a means to map the fastest routes for their customers.
I believe Internap has co-located DNS servers all over the world for this 
purpose, that are designed to issue coordinated pings and report on latency 
to a target host back to their network. There have been some mentions of it 
on incidents at ...35... and sans.org.

-Joe

-- 
Joe Stewart
Information Security Analyst 
LURHQ Corporation
==========================>
http://www.lurhq.com/
jstewart at ...262...



More information about the Snort-users mailing list