[Nottingham] Weird Stuff

[Robert Davies]

On Saturday 07 September 2002 18:09, you wrote:
> On Fri, 6 Sep 2002, Robert Davies wrote:

> > It's fun enough on dialup when you get a rare '.255' address doled out to
> > you, you get to see how many chatty 'doze PCs are out there.
>
> That's quite fine, if they're using prefixes shorter than /24 then .255
> isn't always going to be a broadcast address;  or if they're using Pt-to-Pt
> links and routeing /32s through the NAS platform then the issue of subnets
> disappears completely.
>
> ...Presumabley 'doze boxes with broken PPP stacks.  :)

When I noticed it, it was because there seemed to be a significant amount of 
dialup bandwidth, with high number of different PCs sending packets.  It most 
_definitely_ was not 'fine'.  Perhaps the .255 at end was coincidence but I 
doubt it somehow.

Incidentally a couple of months back, there seemed to be concerted efforts to 
port scan NTL dialup (though just possibly I was targetted as 24 bits of my 
address would often be visible in IRC).  I noticed a lot of log activity from 
various different networks (many broadband) attempting connects to ports with 
past well known  vulnerabilities (eg. sunrpc, netbios, ssh).  Whilst it was 
going on the service was significantly degraded, though it passed after a 
couple of days.

Rob