Yes, it was a middlebox of some sort listening on ports 25 and 80.
On Wed, Sep 17, 2014 at 1:14 PM, Sleigh, Robert <[email protected]> wrote:
> I'd guess the 1.2.3.50 IP relates to a destination rather than your device's
> source IP
>
> Probably relates to a content optimisation solution sat inside Vodaphone data
> network, used to resize images or re-code video streams to match end user
> device capabilities and so reduce download traffic volumes
>
> Regards
>
> Bob
>
> ________________________________________
> From: uknof [[email protected]] on behalf of
> [email protected] [[email protected]]
> Sent: 17 September 2014 12:00
> To: [email protected]
> Subject: uknof Digest, Vol 69, Issue 34
>
> Send uknof mailing list submissions to
> [email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://lists.uknof.org.uk/cgi-bin/mailman/listinfo/uknof
> or, via email, send a message with subject or body 'help' to
> [email protected]
>
> You can reach the person managing the list at
> [email protected]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of uknof digest..."
>
>
> Today's Topics:
>
> 1. Re: Virgin Media Products (Peter Knapp)
> 2. Re: Vodafone UK/AS25135, 1.2.3.50 O RLY? (Greg Choules)
> 3. Re: Vodafone UK/AS25135, 1.2.3.50 O RLY? (Peter Knapp)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 16 Sep 2014 21:00:53 +0000
> From: Peter Knapp <[email protected]>
> To: Howard Jones <[email protected]>, "[email protected]"
> <[email protected]>
> Subject: Re: [uknof] Virgin Media Products
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset="us-ascii"
>
> And heaven help you if you centre around Telehouse when any maintenance at
> Poplar means youve got a customer notification list of hundreds or thousands.
>
> We learned that pretty quickly and home regionally on a selection of pops now
> thankfully
>
>
> Peter Knapp
>
>
>
> -------- Original message --------
> From: Howard Jones <[email protected]>
> Date:16/09/2014 22:58 (GMT+02:00)
> To: [email protected]
> Cc:
> Subject: Re: [uknof] Virgin Media Products
>
> On 16/09/2014 20:19, Tom Hill wrote:
>> On 16/09/14 13:56, Chris Russell wrote:
>>> IPVPN - VM version of IPClear (over 3G, Broadband, etc etc)
>> Including National Ethernet, too. 20Mbit lines terminated on Alcatel
>> NTEs *and* 3900 ISR G2s.
>>
>> *grumbles at rack utilisation*
>>
> Also, don't bother with National Ethernet if you want an 'always up'
> line - there is a weekly maintenance window that gets used for something
> most weeks, as far as I can tell. If you have a number of these
> circuits, most wednesday mornings will greet you with a mail from
> someone asking about ospf flaps overnight.
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> <https://lists.uknof.org.uk/cgi-bin/mailman/private/uknof/attachments/20140916/02d439d8/attachment-0001.html>
>
> ------------------------------
>
> Message: 2
> Date: Tue, 16 Sep 2014 17:09:01 +0000
> From: Greg Choules <[email protected]>
> To: Alexander Harrowell <[email protected]>,
> "[email protected]" <[email protected]>
> Subject: Re: [uknof] Vodafone UK/AS25135, 1.2.3.50 O RLY?
> Message-ID:
> <dfa21e15c6be9b4db0321e29a1a7daa7ff2df...@mr1-wcs-exm01.corpuk.net>
> Content-Type: text/plain; charset="utf-8"
>
> My *guess* is that there are insufficient RFC1918 (v4) addresses to go around
> both 3G and 4G mobile terminals and since everything that needs to go
> externally will be NATed to a public IP anyway it doesn't matter what is used
> between your handset and VF's packet core. Anything you choose potentially
> looks like you are squatting on someone else's space. At least they picked
> what looked like an unannounced (at the time) prefix.
>
> Greg
>
> -----Original Message-----
> From: uknof [mailto:[email protected]] On Behalf Of Alexander
> Harrowell
> Sent: 16 September 2014 14:44
> To: [email protected]
> Subject: [uknof] Vodafone UK/AS25135, 1.2.3.50 O RLY?
>
> I was a little surprised, using Vodafone LTE as a backup link yesterday
> morning, to see "Read 1.2.3.50" from my web browser.
> 1.2.3.50 isn't a Vodafone netblock and is actually an APNIC debogon.
> Squatting in 1/8 is a bit dated isn't it?
>
> Seems to be some sort of proxy listening on 80 and 25.
>
> whois 1.2.3.50
> % [whois.apnic.net]
> % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
>
> % Information related to '1.2.3.0 - 1.2.3.255'
>
> inetnum: 1.2.3.0 - 1.2.3.255
> netname: Debogon-prefix
> descr: APNIC Debogon Project
> descr: APNIC Pty Ltd
> country: AU
> admin-c: AR302-AP
> tech-c: AR302-AP
> mnt-by: APNIC-HM
> mnt-routes: MAINT-AU-APNIC-GM85-AP
> mnt-irt: IRT-APNICRANDNET-AU
> status: ASSIGNED PORTABLE
> changed: [email protected] 20110922
> source: APNIC
>
> irt: IRT-APNICRANDNET-AU
> address: PO Box 3646
> address: South Brisbane, QLD 4101
> address: Australia
> e-mail: [email protected]
> abuse-mailbox: [email protected]
> admin-c: AR302-AP
> tech-c: AR302-AP
> auth: # Filtered
> mnt-by: MAINT-AU-APNIC-GM85-AP
> changed: [email protected] 20110922
> source: APNIC
>
> role: APNIC RESEARCH
> address: PO Box 3646
> address: South Brisbane, QLD 4101
> address: Australia
> country: AU
> phone: +61-7-3858-3188
> fax-no: +61-7-3858-3199
> e-mail: [email protected]
> remarks: ++++++++++++++++++
> remarks: + Address blocks listed with this contact
> remarks: + are withheld from general use and are
> remarks: + only routed briefly for passive testing.
> remarks: +
> remarks: + If you are receiving unwanted traffic
> remarks: + it is almost certainly spoofed source
> remarks: + or hijacked address usage.
> remarks: +
> remarks: + http://en.wikipedia.org/wiki/IP_address_spoofing
> remarks: + http://en.wikipedia.org/wiki/Regional_internet_registry
> remarks: +
> remarks: ++++++++++++++++++
> nic-hdl: AR302-AP
> tech-c: AH256-AP
> admin-c: AH256-AP
> mnt-by: MAINT-APNIC-AP
> changed: [email protected] 20110822
> source: APNIC
>
> % This query was served by the APNIC Whois Service version
> 1.69.1-APNICv1r0 (WHOIS4)
>
>
> ________________________________________________________________________
>
> This e-mail message (including any attachment) is intended only for the
> personal use of the recipient(s) named above. This message is confidential
> and may be legally privileged. If you are not an intended recipient, you may
> not review, copy or distribute this message. If you have received this
> communication in error, please notify us immediately by e-mail and delete the
> original message.
>
> Any views or opinions expressed in this message are those of the author only.
> Furthermore, this message (including any attachment) does not create any
> legally binding rights or obligations whatsoever, which may only be created
> by the exchange of hard copy documents signed by a duly authorised
> representative of Hutchison 3G UK Limited. Hutchison 3G UK Limited is a
> company registered in England and Wales with company number 3885486.
> Registered Office Star House, 20 Grenfell Road, Maidenhead, Berkshire SL6 1EH
> ________________________________________________________________________
>
>
> ------------------------------
>
> Message: 3
> Date: Tue, 16 Sep 2014 23:26:07 +0000
> From: Peter Knapp <[email protected]>
> To: Greg Choules <[email protected]>,
> "[email protected]" <[email protected]>
> Subject: Re: [uknof] Vodafone UK/AS25135, 1.2.3.50 O RLY?
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset="us-ascii"
>
> Greg.
>
> Im buying your arguement re 1918 space for the handsets but surely if you
> stuck a 1918 10x range on each HLG even the biggest mobile op would have
> space?
>
>
> Pete
>
>
> -------- Original message --------
> From: Greg Choules <[email protected]>
> Date:17/09/2014 01:56 (GMT+02:00)
> To: Alexander Harrowell <[email protected]>,[email protected]
> Cc:
> Subject: Re: [uknof] Vodafone UK/AS25135, 1.2.3.50 O RLY?
>
> My *guess* is that there are insufficient RFC1918 (v4) addresses to go around
> both 3G and 4G mobile terminals and since everything that needs to go
> externally will be NATed to a public IP anyway it doesn't matter what is used
> between your handset and VF's packet core. Anything you choose potentially
> looks like you are squatting on someone else's space. At least they picked
> what looked like an unannounced (at the time) prefix.
>
> Greg
>
> -----Original Message-----
> From: uknof [mailto:[email protected]] On Behalf Of Alexander
> Harrowell
> Sent: 16 September 2014 14:44
> To: [email protected]
> Subject: [uknof] Vodafone UK/AS25135, 1.2.3.50 O RLY?
>
> I was a little surprised, using Vodafone LTE as a backup link yesterday
> morning, to see "Read 1.2.3.50" from my web browser.
> 1.2.3.50 isn't a Vodafone netblock and is actually an APNIC debogon.
> Squatting in 1/8 is a bit dated isn't it?
>
> Seems to be some sort of proxy listening on 80 and 25.
>
> whois 1.2.3.50
> % [whois.apnic.net]
> % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
>
> % Information related to '1.2.3.0 - 1.2.3.255'
>
> inetnum: 1.2.3.0 - 1.2.3.255
> netname: Debogon-prefix
> descr: APNIC Debogon Project
> descr: APNIC Pty Ltd
> country: AU
> admin-c: AR302-AP
> tech-c: AR302-AP
> mnt-by: APNIC-HM
> mnt-routes: MAINT-AU-APNIC-GM85-AP
> mnt-irt: IRT-APNICRANDNET-AU
> status: ASSIGNED PORTABLE
> changed: [email protected] 20110922
> source: APNIC
>
> irt: IRT-APNICRANDNET-AU
> address: PO Box 3646
> address: South Brisbane, QLD 4101
> address: Australia
> e-mail: [email protected]
> abuse-mailbox: [email protected]
> admin-c: AR302-AP
> tech-c: AR302-AP
> auth: # Filtered
> mnt-by: MAINT-AU-APNIC-GM85-AP
> changed: [email protected] 20110922
> source: APNIC
>
> role: APNIC RESEARCH
> address: PO Box 3646
> address: South Brisbane, QLD 4101
> address: Australia
> country: AU
> phone: +61-7-3858-3188
> fax-no: +61-7-3858-3199
> e-mail: [email protected]
> remarks: ++++++++++++++++++
> remarks: + Address blocks listed with this contact
> remarks: + are withheld from general use and are
> remarks: + only routed briefly for passive testing.
> remarks: +
> remarks: + If you are receiving unwanted traffic
> remarks: + it is almost certainly spoofed source
> remarks: + or hijacked address usage.
> remarks: +
> remarks: + http://en.wikipedia.org/wiki/IP_address_spoofing
> remarks: + http://en.wikipedia.org/wiki/Regional_internet_registry
> remarks: +
> remarks: ++++++++++++++++++
> nic-hdl: AR302-AP
> tech-c: AH256-AP
> admin-c: AH256-AP
> mnt-by: MAINT-APNIC-AP
> changed: [email protected] 20110822
> source: APNIC
>
> % This query was served by the APNIC Whois Service version
> 1.69.1-APNICv1r0 (WHOIS4)
>
>
> ________________________________________________________________________
>
> This e-mail message (including any attachment) is intended only for the
> personal use of the recipient(s) named above. This message is confidential
> and may be legally privileged. If you are not an intended recipient, you may
> not review, copy or distribute this message. If you have received this
> communication in error, please notify us immediately by e-mail and delete the
> original message.
>
> Any views or opinions expressed in this message are those of the author only.
> Furthermore, this message (including any attachment) does not create any
> legally binding rights or obligations whatsoever, which may only be created
> by the exchange of hard copy documents signed by a duly authorised
> representative of Hutchison 3G UK Limited. Hutchison 3G UK Limited is a
> company registered in England and Wales with company number 3885486.
> Registered Office Star House, 20 Grenfell Road, Maidenhead, Berkshire SL6 1EH
> ________________________________________________________________________
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> <https://lists.uknof.org.uk/cgi-bin/mailman/private/uknof/attachments/20140916/fbecd9ae/attachment-0001.html>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> uknof mailing list
> [email protected]
> https://lists.uknof.org.uk/cgi-bin/mailman/listinfo/uknof
>
> ------------------------------
>
> End of uknof Digest, Vol 69, Issue 34
> *************************************
> NOTICE AND DISCLAIMER
> This e-mail (including any attachments) is intended for the above-named
> person(s). If you are not the intended recipient, notify the sender
> immediately, delete this email from your system and do not disclose or use
> for any purpose.
>
> We may monitor all incoming and outgoing emails in line with current
> legislation. We have taken steps to ensure that this email and attachments
> are free from any virus, but it remains your responsibility to ensure that
> viruses do not adversely affect you.
>
> EE Limited
> Registered in England and Wales
> Company Registered Number: 02382161
> Registered Office Address: Trident Place, Mosquito Way, Hatfield,
> Hertfordshire, AL10 9BW
>
