Tracing where it started

Sun Jan 26 03:30:56 UTC 2003

On Sat, 25 Jan 2003, Brian Coyle wrote:

> I have a similar packet (but only one) from the same host (time is ntp sync'd
> EST).
>
> Jan 20 12:55:47 firewall kernel: Packet log: input - ppp0 PROTO=17
> 67.8.33.179:1 65.83.153.253:1434 L=29 S=0x00 I=20300 F=0x0000 T=110 (#23)

That's a busy machine apparently:

Jan 19 01:13:16 gw ipmon[32123]: 01:13:15.993484 ed0 @0:20 b 67.8.33.179,1
-> 66.92.x.x,1434 PR udp len 20 29  IN

(also EST, NTP synced)

C

> - --
> Redundancy?  You can say that again!
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (GNU/Linux)
> Comment: Brian Coyle, GCIA                         http://www.giac.org/GCIA.php
>
> iD8DBQE+Mz9gER3MuHUncBsRAuG3AJ0Xzd+QiDeX6LKHX4frfRF40xJK8gCfUgXw
> g7uoFXH2N72uwLudo2OuvpI=
> =Kw/8
> -----END PGP SIGNATURE-----
>