>i've been receiving a handful of UDP echo packets on an email server since
>december 1, consistently from the same IP address
>00/12/1_at_10:44:08: FAIL: echo-dgram address from=169.254.97.28
The 169.254 block is reserved for Link Local use.
I'm not sure if this is relevant to your problem, but look at this
excerpt from RFC 2491 (IPv6 over NBMA Networks):
Any Redirect message sent by a router MUST conform to all the
rules described in [7] so that the packet is properly validated by
the receiving host. Specifically, if the target of the resulting
short-cut is the destination host then the ICMP Target Address
MUST be the same as the ICMP Destination Address in the original
message. If the target of the short-cut is an egress router then
the ICMP Target Address MUST be a Link Local address of the egress
router that is unique to the NBMA cloud to which the router's NBMA
interface is attached.
Could be a config error inside your metwork?
Just a thought. It doesn't make a lot of sense as an
information-gathering tool.
Cheers,
RGF
Robert G. Ferrell, CISSP
Information Systems Security Officer
National Business Center
U. S. Dept. of the Interior
Robert_G_Ferrell_at_nbc.gov
========================================
Who goeth without humor goeth unarmed.
========================================
Received on Dec 12 2000
Intro
