It's possible you have a client on your network attempting to access a mis-configured web server farm. Normally requests would go to a front-door server and get NAT'd back to another set of servers to actually handle the request. For some reason, the responses from these servers are not getting NAT'd back to the original source address so they appear as spurious packets from a private address space on port 80. David -----Original Message----- From: Jackie [mailto:JackieJat_private] Sent: Friday, August 23, 2002 18:57 To: incidentsat_private Subject: What's going on here? ZoneAlarm reported this burst, all from port 80 on a reserved IP block. What the honk's going on? ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Aug 26 2002 - 11:11:06 PDT