Anyone recognize this traffic???

[scottishrocket]

I'm getting a lot of traffic coming from one interface that looks suspect to me. I just cant pin it down to what is going on there though.
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Gi1/0.43 127.0.0.141 Se4/0 108.122.0.0 00 0000 0000 3
Gi1/0.43 127.0.0.140 Se4/0 108.122.0.0 00 0000 0000 2
Gi1/0.43 127.0.0.143 Se4/0 108.122.0.0 00 0000 0000 3
Gi1/0.43 127.0.0.142 Se4/0 108.122.0.0 00 0000 0000 2
Gi1/0.43 127.0.0.136 Se4/0 108.122.0.0 00 0000 0000 3
Gi1/0.43 127.0.0.138 Se4/0 108.122.0.0 00 0000 0000 3
Gi1/0.43 127.0.0.133 Se4/0 108.122.0.0 00 0000 0000 3
Gi1/0.43 127.0.0.132 Se4/0 108.122.0.0 00 0000 0000 4
Gi1/0.43 127.0.0.135 Se4/0 108.122.0.0 00 0000 0000 2
Gi1/0.43 127.0.0.134 Se4/0 108.122.0.0 00 0000 0000 3
Gi1/0.43 127.0.0.129 Se4/0 108.122.0.0 00 0000 0000 3
Gi1/0.43 127.0.0.131 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.130 Se4/0 108.122.0.0 00 0000 0000 4
Gi1/0.43 127.0.0.156 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.159 Se4/0 108.122.0.0 00 0000 0000 8
Gi1/0.43 127.0.0.158 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.153 Se4/0 108.122.0.0 00 0000 0000 9
Gi1/0.43 127.0.0.152 Se4/0 108.122.0.0 00 0000 0000 5
Gi1/0.43 127.0.0.155 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.149 Se4/0 108.122.0.0 00 0000 0000 3
Gi1/0.43 127.0.0.148 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.151 Se4/0 108.122.0.0 00 0000 0000 6
Gi1/0.43 127.0.0.150 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.145 Se4/0 108.122.0.0 00 0000 0000 5
Gi1/0.43 127.0.0.144 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.146 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.173 Se4/0 108.122.0.0 00 0000 0000 6
Gi1/0.43 127.0.0.172 Se4/0 108.122.0.0 00 0000 0000 1
Gi1/0.43 127.0.0.175 Se4/0 108.122.0.0 00 0000 0000 2
Gi1/0.43 127.0.0.174 Se4/0 108.122.0.0 00 0000 0000 2
Gi1/0.43 127.0.0.168 Se4/0 108.122.0.0 00 0000 0000 5
Gi1/0.43 127.0.0.171 Se4/0 108.122.0.0 00 0000 0000 9

just so you all know this is a clients network that won't just let me in to look at their systems without probable cause

thanks

 

[baddos]

Well... You should be blocking that netblock anyways.

access-list 101 deny ip 127.0.0.0 0.0.0.255 any

 

[limejudo]

Yeah block that traffic!!!!!!!



Eric - A+, Net+, INet+ CCNA next week.
Network Admin/Helpdesk II

http://www.usunwired.com