Sorry, but if it wasn't pings, I would of said icmp unreachable or
something else.
173.48.105.218 > 38.117.195.101: ICMP echo request, id 29502, seq 0, length 84
74.15.195.47 > 38.117.195.101: ICMP echo request, id 60552, seq 0, length 84
66.75.115.187 > 38.117.195.101: ICMP echo request, id 1467, seq 0, length 84
99.14.217.191 > 38.117.195.101: ICMP echo request, id 26729, seq 0, length 84
71.146.132.16 > 38.117.195.101: ICMP echo request, id 3623, seq 0, length 84
67.49.184.19 > 38.117.195.101: ICMP echo request, id 64819, seq 0, length 84
71.146.132.16 > 38.117.195.101: ICMP echo request, id 5415, seq 0, length 84
67.177.209.104 > 38.117.195.101: ICMP echo request, id 939, seq 0, length 84
75.14.217.47 > 38.117.195.101: ICMP echo request, id 52005, seq 0, length 84
67.49.184.19 > 38.117.195.101: ICMP echo request, id 4404, seq 0, length 84
71.229.240.241 > 38.117.195.101: ICMP echo request, id 42619, seq 0, length 84
129.33.82.49 > 38.117.195.101: ICMP echo request, id 1, seq 12167, length 58
67.162.226.72 > 38.117.195.101: ICMP echo request, id 36433, seq 0, length 84
67.162.226.72 > 38.117.195.101: ICMP echo request, id 38225, seq 0, length 84
173.67.2.96 > 38.117.195.101: ICMP echo request, id 14681, seq 0, length 84
72.194.195.183 > 38.117.195.101: ICMP echo request, id 21537, seq
1537, length 84
71.198.244.223 > 38.117.195.101: ICMP echo request, id 9234, seq 0, length 84
71.198.244.223 > 38.117.195.101: ICMP echo request, id 48545, seq 0, length 84
65.189.52.88 > 38.117.195.101: ICMP echo request, id 64518, seq 0, length 84
192.234.130.5 > 38.117.195.101: ICMP echo request, id 989, seq 2, length 1480
70.183.53.154 > 38.117.195.101: ICMP echo request, id 43875, seq 1, length 64
129.33.82.56 > 38.117.195.101: ICMP echo request, id 1, seq 61047, length 58
129.33.82.57 > 38.117.195.101: ICMP echo request, id 1, seq 11847, length 58
129.33.82.59 > 38.117.195.101: ICMP echo request, id 1, seq 18663, length 58
129.33.82.51 > 38.117.195.101: ICMP echo request, id 1, seq 39615, length 58
129.33.82.53 > 38.117.195.101: ICMP echo request, id 1, seq 15675, length 58
129.33.82.52 > 38.117.195.101: ICMP echo request, id 1, seq 61739, length 58
129.33.82.49 > 38.117.195.101: ICMP echo request, id 1, seq 11023, length 58
129.33.82.56 > 38.117.195.101: ICMP echo request, id 1, seq 9963, length 58
129.33.82.58 > 38.117.195.101: ICMP echo request, id 1, seq 44007, length 58
129.33.82.57 > 38.117.195.101: ICMP echo request, id 1, seq 17959, length 58
129.33.82.59 > 38.117.195.101: ICMP echo request, id 1, seq 15951, length 58
129.33.82.51 > 38.117.195.101: ICMP echo request, id 1, seq 17135, length 58
129.33.82.53 > 38.117.195.101: ICMP echo request, id 1, seq 46751, length 58
129.33.82.52 > 38.117.195.101: ICMP echo request, id 1, seq 43183, length 58
129.33.82.49 > 38.117.195.101: ICMP echo request, id 1, seq 18711, length 58
129.33.82.56 > 38.117.195.101: ICMP echo request, id 1, seq 64403, length 58
129.33.82.58 > 38.117.195.101: ICMP echo request, id 1, seq 57671, length 58
129.33.82.57 > 38.117.195.101: ICMP echo request, id 1, seq 28959, length 58
129.33.82.59 > 38.117.195.101: ICMP echo request, id 1, seq 46215, length 58
129.33.82.51 > 38.117.195.101: ICMP echo request, id 1, seq 13603, length 58
Quoting Chuck Swiger <[email protected]>:
On Dec 3, 2009, at 7:08 PM, Patrick Domack wrote:
I was diagnosing a completely unrelated issue and saw these in my
tcpdumps and though I would inspect more.
I noticed to my ntp server in the pool, craploads of icmp requests
per second (about 1/50th the amount of ntp requests).
Most of these send several icmp requests every so often, then an
ntp request.
Just wondering if anyone knows what this is?
You'd have to provide a few more details about what type of ICMP
traffic you are seeing. ICMP host/network unreachable or
"administratively prohibited" message types commonly are from
misconfigured or brain-dead firewalls that permit their internal
networks to send out NTP queries but reject the NTP replies sent
back with an ICMP error message.
I have noticed it from a few nat gateways. but then I am also
seeing it from a large continuous ip space from ibm.
You should contact [email protected] or whoever the listed whois
contact for these IPs are.
Regards,
--
-Chuck
_______________________________________________
timekeepers mailing list
[email protected]
https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
