RE: What's going on here?

From: NESTING, DAVID M (SBCSI) (dn3723at_private)
Date: Mon Aug 26 2002 - 09:26:10 PDT

  • Next message: Yonatan Bokovza: "RE: What's going on here?"

    It's possible you have a client on your network attempting to access a
    mis-configured web server farm.  Normally requests would go to a front-door
    server and get NAT'd back to another set of servers to actually handle the
    request.  For some reason, the responses from these servers are not getting
    NAT'd back to the original source address so they appear as spurious packets
    from a private address space on port 80.
    -----Original Message-----
    From: Jackie [mailto:JackieJat_private]
    Sent: Friday, August 23, 2002 18:57
    To: incidentsat_private
    Subject: What's going on here?
    ZoneAlarm reported this burst, all from port 80 on a reserved IP
    block. What the honk's going on?
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see:

    This archive was generated by hypermail 2b30 : Mon Aug 26 2002 - 11:11:06 PDT