Signature 4613

[ddinh]

This signature keeps alarming on incoming Cerfnet addresses. I'm going to iplog and analyse the data but in the mean time, is anyone else experiencing the same?

Here's some samples:

1/21/2003 | 10:39:03 | OUT | IN | 4613 | 63.241.203.113 | x.x.97.127 | 0 | 2663 | GET/PUT filename

1/21/2003 | 12:00:02 | OUT | IN | 4613 | 216.148.215.102 | x.x.87.171 | 0 | 1146 | GET/PUT filename

1/21/2003 | 12:29:40 | OUT | IN | 4613 | 216.148.215.100 | x.x.87.171 | 0 | 1262 | GET/PUT filename

1/17/2003 | 10:05:08 | OUT | IN | 4613 | 12.129.196.176 | x.x.198.29 | 0 | 4997 | GET/PUT filename

1/17/2003 | 11:06:37 | OUT | IN | 4613 | 199.106.211.174 | x.x.98.21 | 0 | 1535 | GET/PUT filenam

[mcerha]

Could you send me a copy of the traffic (snoop / tcpdump)? We've had a similar complaint, but I can't get enough information to verify the problem. It would be a big help. Please send any info to mcerha@cisco.com.