cancel
Showing results for 
Search instead for 
Did you mean: 

Very weird moment...

IanSn
Grafter
Posts: 492
Thanks: 5
Registered: ‎25-09-2011

Very weird moment...

...updating my security stuff, network siezed up and got weird error. (Didn't get time to read, it disappeard quickly.)
Then suddenly activity at a speed I've never seen the likes of. Didn't know my connection could ever go that fast.
Then stopped.
Checked the destination IP -
NetRange:       198.18.0.0 - 198.19.255.255
CIDR:           198.18.0.0/15
OriginAS:      
NetName:        SPECIAL-IPV4-BENCHMARK-TESTING-IANA-RESERVED
NetHandle:      NET-198-18-0-0-1
Parent:         NET-198-0-0-0-0
NetType:        IANA Special Use
Comment:        Addresses starting with "198.18." or "198.19." are set aside for use in
isolated laboratory networks used for benchmarking and performance testing.  They should never
appear on the Internet and if you see Internet traffic using these addresses, they are being
used without permission.

Comment:        
Comment:        This assignment was made by the IETF, the organization that develops Internet
protocols, in RFC 2544, which can be found at:
Comment:        http://datatracker.ietf.org/doc/rfc2544
[my italics]
OrgTechName:  Internet Corporation for Assigned Names and Number
OrgTechPhone:  +1-310-301-5820
OrgTechEmail:  abuse@iana.org

Huh  Shocked
Advice anyone?
5 REPLIES
Community Veteran
Posts: 5,222
Thanks: 494
Fixes: 22
Registered: ‎10-06-2010

Re: Very weird moment...

IP addresses in that 198.18. range are returned by the DNS forwarder in technicolor routers for "WANDownSpoofing" (which is supposed to be when the Internet connection is down).
IanSn
Grafter
Posts: 492
Thanks: 5
Registered: ‎25-09-2011

Re: Very weird moment...

Can you explain what "WANDownSpoofing" is?
The IANA page says that this IP
"should never appear on the Internet and
if you see Internet traffic using these
addresses, they are being used without
permission".
TORPC
Grafter
Posts: 5,163
Registered: ‎08-12-2013

Re: Very weird moment...

This search suggests that the "WANDownSpoofing" is known on the Technicolor routers worldwide
IanSn
Grafter
Posts: 492
Thanks: 5
Registered: ‎25-09-2011

Re: Very weird moment...

There was also this thread on here which I didn't see earlier -
https://community.plus.net/forum/index.php/topic,116173.0.html
Do have wireshark but wasn't runnng at the time.
TORPC
Grafter
Posts: 5,163
Registered: ‎08-12-2013

Re: Very weird moment...

That is the 2nd down from the top in the link I gave earlier, which was my main prompt for posting said link Wink