Security Incidents: Spooky traffic from a loopback address?

[Clinton Smith <security () infosecwest com>]

Greetings all,

I have begun to see sparse connections of the following nature:
127.0.0.2:HIGHPORT --> 192.168.0.1:80 (SYN)
3 or 4 at a time coming from an internet gateway.

I have read the following:
http://online.securityfocus.com/archive/1/166648

Q Has anyone seen this type of packet or am I just seeing
badly configured network devices?

Kind Regards,
Clinton


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com