[nos-bbs] strange udp broadcasts...

[Jerome Schatten]

Thanks to all that alerted the 209.189.196.68 guys. They seem to be gone 
now.

However they have been replaced by:

Thu Jan 30 20:09:02 2014 - tun0 recv:
IP: len 159 63.227.187.228->192.168.1.149 ihl 20 ttl 53 DF prot IP
IP: len 139 44.12.3.97->255.255.255.255 ihl 20 ttl 64 DF prot UDP
UDP: len 119 5678->5678 Data 111
0000 ..,}....ValeNet_1.254....6.7....MikroTik....d.......H6B3-M9R9...
0040 .RB2011UAS-2HnD.........ipip-ampr-24.84.205.232
(encap)  44.12.3.97->255.255.255.255 DF UDP
0000 ..,}....ValeNet_1.254....6.7....MikroTik....d.......H6B3-M9R9...
0040 .RB2011UAS-2HnD.........ipip-ampr-24.84.205.232

The good nooze is the broadcast interval seems to be every five minutes 
rather than every minute. Much more liveable, but still... Different 
guys, same stuff?  Maybe they're not finished cleaning up?

jerome -- ve7ass

On 14-01-29 09:49 PM, Jerome Schatten wrote:
> 44ers...
>
> So every minute of every hour of every day, I get this below; it 
> started several weeks ago.  It looks like it's coming from the Ampr 
> portal -- why?  24.84.205.232 is indeed my ip and it seems that 
> 209.84.205.232 is the same ip as the rip broadcasts are coming from. 
> Is there any way to turn this off other than turning off rip?
>
> Wed Jan 29 21:35:27 2014 - tun0 recv:
> IP: len 167 209.189.196.68->192.168.1.149 ihl 20 ttl 55 DF prot IP
> IP: len 147 0.0.0.0->255.255.255.255 ihl 20 ttl 64 prot UDP
> UDP: len 127 5678->5678 Data 119
> 0000 ..1.....Seattle-ER1....6.7....MikroTik............FLNH-GLS0....R
> 0040 B2011UAS......................T......ampr-24.84.205.232
> (encap)  0.0.0.0->255.255.255.255 UDP
> 0000 ..1.....Seattle-ER1....6.7....MikroTik............FLNH-GLS0....R
> 0040  B2011UAS......................T......ampr-24.84.205.232
>
> jerome - ve7ass
>
> _______________________________________________
> nos-bbs mailing list
> nos-bbs at tapr.org
> http://www.tapr.org/mailman/listinfo/nos-bbs
>