This sort of stuff really gets me puzzled. Why would anyone use IANA reserved space for probes, if the path back to respond to these probes will end up in the drain anyway? And why do I see so many from 172.31.0.0/24? Is this a Wintendo doing 7 bit over ethernet thinking it is multicasting?:) I'm wondering if anyone else is seeing more strange traffic from this particular range and/or has a theory. Cheers, Pi ============================================================================ Firewall report for 172.31.0.128 ============================================================================ [whois.radb.net] % No entries found for the selected source(s). ---------------------------------------------------------------------------- History summary for the source network ---------------------------------------------------------------------------- Total incidents from BLK-172.31.0 : 14 Total hosts from BLK-172.31.0 : 9 Total matched packets : 63 Avg incidents/month : 4.77 ---------------------------------------------------------------------------- Log events recorded in CET(GMT+0100) ntp-synched ---------------------------------------------------------------------------- Feb 9 10:37:52 rot-00-border access-list 102 deny ethernet0 tcp 172.31.0.128:8080 62.250.1.2:3199 L=40 S=0x00 I=295 ---------------------------------------------------------------------------- Local network resources ---------------------------------------------------------------------------- 62.250.1.2 jones.lab.madscience.nl ---------------------------------------------------------------------------- Incident history for BLK-172.31.0 ---------------------------------------------------------------------------- 01/30/01 172.31.0.121 01/31/01 172.31.0.121 01/31/01 172.31.0.122 01/31/01 172.31.0.124 01/31/01 172.31.0.54 02/03/01 172.31.0.122 02/03/01 172.31.0.58 02/04/01 172.31.0.127 02/08/01 172.31.0.121 02/08/01 172.31.0.124 02/08/01 172.31.0.127 02/08/01 172.31.0.55 02/08/01 172.31.0.56 02/09/01 172.31.0.128