Been constantly pinged.

Shadow-Lord

On Eircom Enhanced i-stream package.

My firewall is been constantly hammered by pings from 2 sources.
Is anyone else having this problem.


213.94.143.243

netname: EIRCOM
descr: eircom Ltd
descr: ISP infrastructure
descr: Ireland
country: IE
admin-c: DC18-RIPE
admin-c: CD1267-RIPE
tech-c: CD1267-RIPE
status: ASSIGNED PA
mnt-by: TE-MNT
notify: networks@eircom.net
changed: cd@eircom.net 20021015
changed: cd@eircom.net 20030605
source: RIPE




213.94.214.252

netname: GLOBETECHLTD
descr: Eircom Customer Assignment
country: IE
admin-c: KK161-RIPE
tech-c: MC215-RIPE
status: ASSIGNED PA
mnt-by: TE-MNT
notify: ripe@eircom.net
remarks: Please send spam and other abuse complaints to abuse@eircom.net
changed: ripe@eircom.net 20030611
source: RIPE

Mutant_Fruit

i'd send an e-mail to the abuse address telling them they're constantly pinging you. And complain that that eats up your cap (which it does!). Each packet is quite small, but if i pings 24x7 for a month it can chew up a considarable amount of cap.

ando

there's no cap on Enhanced :rolleyes:

Mutant_Fruit

there's no cap on Enhanced

oops...

Anyway, i would still send em an e-mail and complain, maybe send one to regular tech support or something.

just a FYI: 1 ping packet per second for 1 month translates as 79 megabytes wasted... and if its 2 packets per second, double that etc

Cake Fiend

When you say "hammered", how many packets per minute are we talking?

Redshift

From my firewall logs

Mon, 2003-11-10 01:15:32 - TCP packet - Source:213.94.214.252,1346,WAN - Destination:192.168.1.2,135,LAN [Drop] - [Inbound Default rule match]
Mon, 2003-11-10 01:18:27 - Administrator login successful - IP:192.168.0.4


I've got load of them anybody care to pick apart the details.

jd

That is an attempted connection to port 135-which on windows 2000 box corresponds to the rpc service (if i remember correctly). Looks like an eircomnet dsl customer is infected with a worm.

Redshift

Interesting, the whole log is full of them from the same IP address going back days. It's from the same IP as Shadow Lord is getting them from, I'm on Istream aswell. Anybody else getting this?

jd

send email to the dsl support crowd..
they should be able to do something aboutt it (even if it is for the perp's benefit)

bricks

Must still be a load of people with the DCOM worm.
I get about 5 or 6 a minute.

Shadow-Lord

Waiting on a reply from abuse@eircom.net