full-disclosure - ICMP Destination Unreachable Port Unreachable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 15 Aug 2006 13:35:04 -0400
From: "Adriel T. Desautels" <simon@...soft.com>
To: Untitled <full-disclosure@...ts.grok.org.uk>
Subject: ICMP Destination Unreachable Port Unreachable

Hi List, 
	I've been receiving this traffic for a while from the same IP address. Does anyone have any idea what type of traffic this might be. Neither the source IP or the target IP have any ports associated with them in this event. Any ideas would be appreciated. I haven't looked into this extensively, figured I'd ask the list first. 

Event: ICMP Destination Unreachable Port Unreachable
Category: misc-activity
Level: 3

Sensor: IDS-1 (1)
Date / Time: 08/15/2006 13:22:33

Module: xxxx

 Event ID: 5769
Original Event ID: 5723

Source: 82.246.252.214 : 0
Destination: x.x.x.49 : 0

--
Payload Length: 145

000 : 00 00 00 00 45 00 00 8D 30 55 00 00 6D 11 03 B2   ....E...0U..m...
010 : 46 5B 83 31 52 F6 FC D6 3F 65 0A 25 00 79 2D E3   F[.1R...?e.%.y-.
020 : 7F 70 02 30 F0 EF 5B 4A A8 5A A2 E0 22 C7 26 F9   p.0..[J.Z..&quot;.&amp;.
030 : 09 C7 E7 11 CC E6 03 24 64 92 0C D1 75 B4 4C 36   .......$d...u.L6
040 : 4B 1D F7 97 DC B8 A2 59 9D E2 81 E0 1B 5C 56 E7   K......Y.....\V.
050 : E9 86 F5 F1 89 A8 E3 77 56 D5 8D B6 69 C9 FD 3F   .......wV...i..?
060 : D2 76 94 0B 54 AF 8F 79 52 4D 05 50 34 19 5F BE   .v..T..yRM.P4._.
070 : 29 F5 48 EE 19 0C 10 5B C7 66 A2 A4 1A D8 D3 29   ).H....[.f.....)
080 : 74 42 C5 37 B0 3F 92 B7 1C 32 F2 14 55 FC 68 02   tB.7.?...2..U.h.
090 : B8                                                .

-- 

Regards, 
    Adriel T. Desautels
    SNOsoft Research Team
    Office: 617-924-4510 || Mobile : 857-636-8882

    ----------------------------------------------
    Vulnerability Research and Exploit Development





BullGuard Anti-virus has scanned this e-mail and found it clean.
Try BullGuard for free: www.bullguard.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/