Dear Peter,
But whois keeps telling me:
ReferralServer: whois://whois.apnic.net
NetRange: 125.0.0.0 - 125.255.255.255 CIDR: 125.0.0.0/8 NetName: APNIC-125 NetType: Allocated to APNIC Comment: This IP address range is not registered in the ARIN database. Comment: For details, refer to the APNIC Whois Database via Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
So I should never have seen a packet from them?
you have only queried arin ip database, which is not the only one. The right one is apnic in this case (asia region). ripe-whois -h WHOIS.APNIC.NET 125.187.32.144 % [whois.apnic.net node-1] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html inetnum: 125.176.0.0 - 125.191.255.255 netname: XPEED country: KR descr: POWERCOM descr: ************************************************ descr: If you would like to find assignment descr: information in detail please refer to descr: the KRNIC Whois Database at descr: http://whois.nic.or.kr/english/index.html descr: ************************************************ admin-c: HM127-AP tech-c: HM127-AP status: Allocated Portable changed: hostmaster@nic.or.kr 20060621 mnt-by: MNT-KRNIC-AP source: APNIC bye, Ingo