127.0.0.x is a loopback address and can only be used locally on any machine. if i ping 127.0.0.x i an pinging the machine that i am logged on to. Leon -----Original Message----- >the subject says most of it: We had an attack with a large amount of >ICMP packets. The new thing about the attack was the address they >seem to appear from: 127.0.0.2. Note that this is no source address >spoofing, they were not packets from 127.0.0.2 to some IP in our >net but packets _from_ 127.0.0.2 _to_ some other address far away >and not in our net. Looking for the way they have been generated ++ Ascend Users Mailing List ++ To unsubscribe: send unsubscribe to ascend-users-request@bungi.com To get FAQ'd: <<A HREF="http://www.nealis.net/ascend/faq">http://www.nealis.net/ascend/faq</A>> </PRE> <!--X-MsgBody-End--> <!--X-Follow-Ups--> <!--X-Follow-Ups-End--> <!--X-References--> <!--X-References-End--> <!--X-BotPNI--> <HR> <UL> <LI>Prev by Date: <STRONG><A HREF="msg11977.html">(ASCEND) MRTG and max4000</A></STRONG> </LI> <LI>Next by Date: <STRONG><A HREF="msg11975.html">(ASCEND) 127.0.0.[2-xxx]</A></STRONG> </LI> <LI>Prev by thread: <STRONG><A HREF="msg11974.html">(ASCEND) Known attacks via 127.0.0.2 (rj0) ?</A></STRONG> </LI> <LI>Next by thread: <STRONG><A HREF="msg11975.html">(ASCEND) 127.0.0.[2-xxx]</A></STRONG> </LI> <LI>Index(es): <UL> <LI><A HREF="maillist.html#11976"><STRONG>Main</STRONG></A></LI> <LI><A HREF="thrd289.html#11976"><STRONG>Thread</STRONG></A></LI> </UL> </LI> </UL> <!--X-BotPNI-End--> <!--X-User-Footer--> <!--X-User-Footer-End--> </BODY> </HTML>