Tracing where it started

Sun Jan 26 05:09:33 UTC 2003

> +-----------------+
> | 216.069.032.086 |  Kentucky Community and Technical College System
> | 066.223.041.231 |  Interland
> | 216.066.011.120 |  Hurricane Electric
> | 216.098.178.081 |  V-Span, Inc.
> +-----------------+

HE.net seems to be a reoccuring theme. (I speak to evil of them --
actually, there are some good people over there).

However, it appears that one of the 'root' boxes of this attack was at HE.
This is the third or fourth time I've seen theit netblocks mentioned as
the source of some of the first packets.

-- Alex Rubenstein, AR97, K2AHR, alex at nac.net, latency, Al Reuben --
--    Net Access Corporation, 800-NET-ME-36, http://www.nac.net   --