Re: Tracking down IP's

[Richard Cobbe <cobbe@directlink.net>]

Lo, on Sunday, December 31, Pollywog did write:

> 
> On Sun, 31 Dec 2000 13:55:26 -0600 (CST), Richard Cobbe said:
> 
> >
> >  Did you change your IP address in the above report?  IIRC, 172.16.*.* is
> >  a block of private addresses.  Packets to this address should be dropped
> >  automatically by an upstream router.  My guess, therefore, is that these
> >  transmissions are coming from somewhere else in your network---probably a
> >  misconfigured SNMP manager who thinks you're an agent.
> 
> I would ask my ISP if it was coming from them or from their upstream
> provider.  I had some odd stuff appearing in my logs once, coming from
> the same IP address, and it was in fact coming from my ISP's upstream
> provider.

Either way, it's still a private IP address range.  NOBODY should let
packets with one of these addresses, either as source or destination, cross
a network boundary.  If the ISP is getting this traffic from its upstrea
provider, it should configure the router between it and the provider to
drop all private address ranges, and let the provider know it's leaking
private IPs.

Richard