I am not sure how it happened, but I wondered if my lan IP may ever show up on the WAN. So I set up a packet capture outside of the WAN interface...
It did.
I think the activity may be my AV and JAVA both connecting to the WAN in search of updates. I have not been able to make the problem repeat...yet. So I cannot give any insight into how this happened. Though I did capture three packets from a different device on a different subnet that were similar but the src port was 80 that time not the dst port.
Nothing since.
Ideas?
No. Time Source Destination Protocol Info
1 0.000000 lan.lan.lan.lan 72.5.124.55 TCP avocent-proxy > http [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
Frame 1 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 14, 2009 14:08:20.094693000
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP RST]
[Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: 3com_hx:hx:hx (00:50:04:hx:hx:hx), Dst: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
Destination: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
Address: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: 3com_hx:hx:hx (00:50:04:hx:hx:hx)
Address: 3com_hx:hx:hx (00:50:04:hx:hx:hx)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src: lan.lan.lan.lan (lan.lan.lan.lan), Dst: 72.5.124.55 (72.5.124.55)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x1f49 (8009)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: TCP (0x06)
Header checksum: 0x5034 [correct]
[Good: True]
[Bad : False]
Source: lan.lan.lan.lan (lan.lan.lan.lan)
Destination: 72.5.124.55 (72.5.124.55)
Transmission Control Protocol, Src Port: avocent-proxy (1078), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
Source port: avocent-proxy (1078)
Destination port: http (80)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x14 (RST, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .1.. = Reset: Set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 0
Checksum: 0x23af [correct]
[Good Checksum: True]
[Bad Checksum: False]
No. Time Source Destination Protocol Info
2 0.000108 lan.lan.lan.lan 72.246.98.17 TCP asprovatalk > http [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
Frame 2 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 14, 2009 14:08:20.094801000
[Time delta from previous captured frame: 0.000108000 seconds]
[Time delta from previous displayed frame: 0.000108000 seconds]
[Time since reference or first frame: 0.000108000 seconds]
Frame Number: 2
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP RST]
[Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: 3com_hx:hx:hx (00:50:04:hx:hx:hx), Dst: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
Destination: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
Address: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: 3com_hx:hx:hx (00:50:04:hx:hx:hx)
Address: 3com_hx:hx:hx (00:50:04:hx:hx:hx)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src: lan.lan.lan.lan (lan.lan.lan.lan), Dst: 72.246.98.17 (72.246.98.17)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x1f4a (8010)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: TCP (0x06)
Header checksum: 0x6968 [correct]
[Good: True]
[Bad : False]
Source: lan.lan.lan.lan (lan.lan.lan.lan)
Destination: 72.246.98.17 (72.246.98.17)
Transmission Control Protocol, Src Port: asprovatalk (1079), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
Source port: asprovatalk (1079)
Destination port: http (80)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x14 (RST, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .1.. = Reset: Set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 0
Checksum: 0x5552 [correct]
[Good Checksum: True]
[Bad Checksum: False]
No. Time Source Destination Protocol Info
3 1219.697817 lan.lan.lan.lan 72.246.98.17 TCP ff-annunc > http [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
Frame 3 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 14, 2009 14:28:39.792510000
[Time delta from previous captured frame: 1219.697709000 seconds]
[Time delta from previous displayed frame: 1219.697709000 seconds]
[Time since reference or first frame: 1219.697817000 seconds]
Frame Number: 3
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP RST]
[Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: 3com_hx:hx:hx (00:50:04:hx:hx:hx), Dst: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
Destination: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
Address: Cisco_hx:hx:hx (00:15:f9:hx:hx:hx)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: 3com_hx:hx:hx (00:50:04:hx:hx:hx)
Address: 3com_hx:hx:hx (00:50:04:hx:hx:hx)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src: lan.lan.lan.lan (lan.lan.lan.lan), Dst: 72.246.98.17 (72.246.98.17)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x89c3 (35267)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: TCP (0x06)
Header checksum: 0xfeee [correct]
[Good: True]
[Bad : False]
Source: lan.lan.lan.lan (lan.lan.lan.lan)
Destination: 72.246.98.17 (72.246.98.17)
Transmission Control Protocol, Src Port: ff-annunc (1089), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
Source port: ff-annunc (1089)
Destination port: http (80)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x14 (RST, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .1.. = Reset: Set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 0
Checksum: 0x264d [correct]
[Good Checksum: True]
[Bad Checksum: False]
This thread was automatically locked due to age.
