Hi
I've been following an ip for about the past week trying to determine what this person has been up to with no luck. Over the past 2 days they have been hitting my firewall with about 7 different ip's in the range which I will post momentarily. It has stopped periodically but when using tcpdump port 80 I see many instances from them once again.

12:56:22.053052 CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3242 > 165.254.12.101.http: S 152256065:152256065(0) win 8192 <mss 1460,nop,nop,sackOK> (DF)
12:56:22.089174 165.254.12.101.http > CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3242: S 4259504041:4259504041(0) ack 152256066 win 65535 <mss 1460,nop,nop,sackOK> (DF)
12:56:22.089562 CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3242 > 165.254.12.101.http: . ack 1 win 8760 (DF)
12:56:22.090183 CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3242 > 165.254.12.101.http: P 1:280(279) ack 1 win 8760 (DF)

12:56:22.780155 CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3245 > 165.254.12.101.http: S 152256793:152256793(0) win 8192 <mss 1460,nop,nop,sackOK> (DF)
12:56:22.789197 poppit03.pogo.com.http > CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3244: P 1116:1303(187) ack 1166 win 24820 (DF)
12:56:22.820501 165.254.12.101.http > CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3245: S 4268719919:4268719919(0) ack 152256794 win 65535 <mss 1460,nop,nop,sackOK> (DF)
12:56:22.820904 CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3245 > 165.254.12.101.http: . ack 1 win 8760 (DF)
12:56:22.821503 CPE0004758dbf50-CM024480006068.cpe.net.cable.rogers.com.3245 > 165.254.12.101.http: P 1:280(279) ack 1 win 8760 (DF)

Has anyone else been seeing the likes of this, or can anyone enlighten me as to what I'm actually seeing here as this sort of thing boggles my mind. I've just been googling this ip and also came up with 165.254.12.101 being some sort of virtual directory.

TIA

gbell

dump the packet contents here

476 packets received by filter
0 packets dropped by kernel

This all I get when I ^C I'm thinking that it could be ad.us.doubleclick.net because I'm seeing quite a number of packets being sent from there also.

well these look like packets you are sending to a verio webserver - do you have a network behind this box, or is this box stand alone.

noc:/home/admin# whois 165.254.12.101

OrgName: Verio, Inc.
OrgID: VRIO
Address: 8005 South Chester Street
Address: Suite 200
City: Englewood
StateProv: CO
PostalCode: 80112
Country: US

ReferralServer: rwhois://rwhois.verio.net:4321/

NetRange: 165.254.0.0 - 165.254.255.255
CIDR: 165.254.0.0/16
NetName: VRIO-165-254
NetHandle: NET-165-254-0-0-1
Parent: NET-165-0-0-0-0
NetType: Direct Allocation
NameServer: NS0.VERIO.NET
NameServer: NS1.VERIO.NET
NameServer: NS2.VERIO.NET
NameServer: NS3.VERIO.NET
NameServer: NS4.VERIO.NET
Comment: ********************************************
Comment: Reassignment information for this block is
Comment: available at rwhois.verio.net port 4321
Comment: ********************************************
RegDate: 2001-02-08
Updated: 2003-08-27

TechHandle: VIA4-ORG-ARIN
TechName: Verio, Inc.
TechPhone: +1-303-645-1900
TechEmail: vipar@verio.net

OrgAbuseHandle: VAC5-ARIN
OrgAbuseName: Verio Abuse Contact
OrgAbusePhone: +1-800-551-1630
OrgAbuseEmail: abuse@verio.net

OrgNOCHandle: VSC-ARIN
OrgNOCName: Verio Support Contact
OrgNOCPhone: +1-800-551-1630
OrgNOCEmail: support@verio.net

OrgTechHandle: VIA4-ORG-ARIN
OrgTechName: Verio, Inc.
OrgTechPhone: +1-303-645-1900
OrgTechEmail: vipar@verio.net

# ARIN WHOIS database, last updated 2003-09-17 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
noc:/home/admin#

That I do someone is browsing on one of my other boxes as we speak so I guess that is what it is.

Thanks

gbell

If you ever want to try and decipher a tcpdump output a little more clearly, try using ethereal. It acts as a GUI for tcpdump, and it gives you the option to decode packet contents and it has a feature to "follow tcp stream" which will essentially give you the decoded output of a reassembled tcp packet stream. It's a useful tool to have around.