198.32.64.12 -- Harmless mis-route or potential exploit?

Tue Sep 2 22:33:42 UTC 2008

On Sep 2, 2008, at 3:24 PM, Dan Mahoney, System Admin wrote:

> Hello all,
>
> While recently trying to debug a CEF issue, I found a good number of  
> packets in my "debug cef drops" output that were all directed at  
> 198.32.64.12 (which I see as being allocated to ep.net but  
> completely unused).
>
> Sep  2 22:03:25: CEF-Drop: Packet for 198.32.64.12 -- no route
> Sep  2 22:03:25: CEF-Drop: Packet for 198.32.64.12 -- no route
> Sep  2 22:03:25: CEF-Drop: Packet for 198.32.64.12 -- no route
> Sep  2 22:03:25: CEF-Drop: Packet for 198.32.64.12 -- no route
> Sep  2 22:03:25: CEF-Drop: Packet for 198.32.64.12 -- no route
> Sep  2 22:03:25: CEF-Drop: Packet for 198.32.64.12 -- no route
> Sep  2 22:03:25: CEF-Drop: Packet for 198.32.64.12 -- no route
> Sep  2 22:03:25: CEF-Drop: Packet for 198.32.64.12 -- no route
>
> Now, as nearly as I can tell, this IP address has never been used  
> for anything, but I see occasional references to it, such as here:
>

Once upon a time, that used to be the IP address for the L Root server.

Steve

>

-----
Steve Conte
conte at isoc.org