Text only | Text with Images

Hurricane Electric's IPv6 Tunnel Broker Forums

General IPv6 Topics => IPv6 Basics & Questions & General Chatter => Topic started by: 3PS on March 13, 2013, 10:17:56 AM

Title: Traffic from an unregistered address pool?
Post by: 3PS on March 13, 2013, 10:17:56 AM
My firewall is blocking a large number of polls from the Russian Federation against my workstation on port 15032 (TeamViewer listens on that port).  In researching the source addresses of the polls I found one address that comes up a total unknown and I was wondering if anyone knows who the prefix is assigned to.  The address is:

2a01:e35:2f02:9510:71a8:ebbd:22f0:c6fc

Cheers!

Pedro
Title: Re: Traffic from an unregistered address pool?
Post by: snarked on March 13, 2013, 10:39:06 AM
The information is available via a "whois" lookup - and indicates France, not Russia.
Title: Re: Traffic from an unregistered address pool?
Post by: broquea on March 13, 2013, 10:48:15 AM
Using tools is hard: http://bgp.he.net/ip/2a01:e35:2f02:9510:71a8:ebbd:22f0:c6fc
Title: Re: Traffic from an unregistered address pool?
Post by: 3PS on March 15, 2013, 09:09:29 AM
Thank you both.  I was using a different lookup method.

This address is the one I was not able to resolve, the others were from the Russian Federation.  As it turns out I traced the source of the polls on the inside and found that tixati was running in the background on the workstation in question.  Apparently it was setup to use both IPV4 & IPV6.
Title: Re: Traffic from an unregistered address pool?
Post by: rchandra on March 16, 2013, 02:58:12 PM
Sometimes it's knowing about the right tool.  If all you've ever used is a pliers to pound in a nail, then someone shows you a hammer, you might say "huzzah!"  http://bgp.he.net/ip/ is one of those tools I never knew about before.  Thank you.
Text only | Text with Images