weird Level3 IP space uploads

Forums » Up and Running » Security » Security » weird Level3 IP space uploads


Uniqs: 719	Share Topic:	RSS topic:	toggle: flat / full normal / watch	Posting:	Post a:	Post a:

Links: ·Hijack This logs? ·Panda Free Tools ·Vundo Removal

Robert Soloway arrested, Spam continues to flood inboxs »
« Security Software Updates - 04 Jun 2007

AlexNYC

join:2001-06-02
Edwards, CO

1 edit

weird Level3 IP space uploads

There has been some weird activity coming out of my network and I can't figure out exactly what it is.

It's going out to various Ip's like
8.255.1.254, 8.255.65.254, 8.255.2.254, 8.255.52.254, etc. on port 80 ... but no actual (http: //) requests ...

Has anyone seen something like this? It has moved quite a bit of data in the last few days.

Here's what I googled, but it didn't help much ...
»bsn.borderware.com/index.php?fn=web

permalink · 2007-06-04 11:15:33 · Print ·

EGeezer
Go Bobcats
Premium
join:2002-08-04
Country!

·Callcentric

·RoadRunner Cable

·AT&T CallVantage

Re: weird Level3 IP space uploads

Not enough information to guess. You need to start at the source of the connection requests. Try running netstat -b on one of the sources to see what application is connecting. Also, running Packetyzer on them can show you what's in the packets being sent.
--
The society which scorns excellence in plumbing as a humble activity and tolerates shoddiness in philosophy because it is an exalted activity will have neither good plumbing nor good philosophy: neither its pipes or its theories will hold water.

permalink · 2007-06-04 12:57:45 · Print ·

rawwhide Zer0 Premium join:2000-09-03 Zero clubs: ·AT&T DSL Service 3 edits	Hamachi? Hamachi uses 5.x.x.x address range. I am not for sure about 8.x.x.x. »www.impresariostudios.com/blog/i···hamachi/ »en.wikipedia.org/wiki/Hamachi -- HUH!!! Blah Blah F'in Blah
	permalink · 2007-06-04 12:58:07 ·

TheWiseGuy
Dog And Butterfly
Premium,MVM
join:2002-07-04
Yonkers, NY

According to IDserve it seems to be a Footprint Server. I believe these were used in the past for Windows Auto-update. Not sure if they still are. You should try and determine what is sending the packets. See

»Security »What is using port XXX on my computer?

»Checking Automatic Update

»www.infoworld.com/cgi-bin/displa···.120.htm
--
Warning, If you post nonsense and use misinformation and are here to argue based on those methods, you will be put on ignore.

permalink · 2007-06-04 13:00:58 · Print ·

AlexNYC join:2001-06-02 Edwards, CO 1 edit	Re: weird Level3 IP space uploads said by TheWiseGuy : I believe these were used in the past for Windows Auto-update. You are absolutelly right ... apparently there is an auto-update that is stuck in a loop on quite a few computers!!! and not just on my network. Thanks to everyone for your help! You hit the nail on the head. Alex
	permalink · 2007-06-04 13:17:36 ·

EGeezer
Go Bobcats
Premium
join:2002-08-04
Country!

·Callcentric

·RoadRunner Cable

·AT&T CallVantage

Re: weird Level3 IP space uploads

Da Wiseguy strikes gold again!

- There was a spate of performance problems recently with Microsoft and/or Windows update, and a couple of patches released for them. You may have that problem in PCs in your net.

See »Problem with Automatic Update since Tuesday

for more.
--
The society which scorns excellence in plumbing as a humble activity and tolerates shoddiness in philosophy because it is an exalted activity will have neither good plumbing nor good philosophy: neither its pipes or its theories will hold water.

permalink · 2007-06-04 13:40:22 · Print ·

TheWiseGuy Dog And Butterfly Premium,MVM join:2002-07-04 Yonkers, NY	I'm glad I could help. EG, good catch on the Auto-update thread, explains why it was happening.
	permalink · 2007-06-05 07:55:21 ·

your comment..

Forums » Up and Running » Security » Security	Robert Soloway arrested, Spam continues to flood inboxs » « Security Software Updates - 04 Jun 2007


Monday, 30-Nov 00:08:01	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com. republican-creole page compression OFF