Re: Unexplainable router log entries mentioning IPSEC from Yahoo IPs

18 Dec 2020


      Yes, we saw them as well:

Dec    18    10:02:00:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.102
Dec    18    08:55:18:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.2
Dec    18    08:05:30:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.4
Dec    18    07:47:35:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.19
Dec    18    07:15:34:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.38
Dec    18    07:09:59:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.100
Dec    18    06:54:57:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.22
Dec    18    06:46:54:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.17
Dec    18    06:38:24:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.35
Dec    18    06:11:09:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.101
Dec    18    05:50:20:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.35
Dec    18    05:49:23:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.7
Dec    18    05:42:18:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.33
Dec    18    05:30:41:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.8
Dec    18    05:24:58:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.21
Dec    18    03:19:04:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.18
Dec    18    05:11:08:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.8
Dec    18    05:09:08:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.33
Dec    18    04:59:50:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.49
Dec    18    04:49:09:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.35
Dec    18    04:28:32:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.52
Dec    18    02:23:25:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.101
Dec    18    04:10:48:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.38
Dec    18    03:13:41:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.36
Dec    18    02:53:18:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.20
Dec    18    02:49:16:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.51
Dec    18    02:45:59:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=66.196.91.232
Dec    18    02:42:21:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.23
Dec    18    02:33:05:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.37
Dec    18    02:30:46:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.50
Dec    18    02:23:02:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.20
Dec    18    00:57:45:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.50
Dec    17    17:06:12:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.18
Dec    17    14:45:06.899:    %CRYPTO-4-RECVD_PKT_INV_SPI: decaps:    
rec'd    IPSEC    packet    has    invalid    spi for    
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.34
Dec    17    16:38:03:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.37
Dec    17    16:28:13:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=203.84.212.40
Dec    17    16:24:06:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.99
Dec    17    15:14:03:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.40
Dec    17    15:06:40:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0x4CF4BE5D(1291107933)    
srcaddr=68.180.160.100
Dec    17    08:57:00:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=68.180.160.23
Dec    17    08:25:36:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=68.180.160.104
Dec    17    08:11:54:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=68.180.160.19
Dec    17    07:22:22:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=203.84.212.55
Dec    17    06:18:55:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=68.180.160.20
Dec    17    06:14:35:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=203.84.212.36
Dec    17    06:13:05:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=203.84.212.17
Dec    17    05:36:24:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=203.84.212.53
Dec    17    01:56:17:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=68.180.160.17
Dec    17    03:27:47:    %CRYPTO-4-RECVD_PKT_INV_SPI:    decaps: 
rec'd    IPSEC    packet    has    invalid    spi    for 
destaddr=<redacted>    prot=50 spi=0xEF7ED795(4018067349)    
srcaddr=203.84.212.34

-- 
Best regards,
Adrian Minta