[Snort-users] 13 instances of ping bsd

Joe Stewart jstewart at ...262...
Tue Nov 28 09:21:41 EST 2000

On Tuesday 28 November 2000 00:47, you wrote:
> hi folks, got 13 of these within millisecs of each other all different IPs
> but apparently same mac address...... none of the addresses have shown up
> before or since. any thoughts?

These are coming from Internap/pnap.net in cooperation with lots of different
backbone providers, as a means to map the fastest routes for their customers.
I believe Internap has co-located DNS servers all over the world for this 
purpose, that are designed to issue coordinated pings and report on latency 
to a target host back to their network. There have been some mentions of it 
on incidents at ...35... and sans.org.


Joe Stewart
Information Security Analyst 
LURHQ Corporation
jstewart at ...262...

More information about the Snort-users mailing list