suspicious IP's. Can it be tunneling ?

[Mustafa Cagatayli <mscag@ciu.edu.tr>]

Hello,

It has been 4 days since out outbound/autodiscover/http traffic has grown 
so much that all our outbound capacity is now full. As this is a port/class 
that needs to be available there is no way for me to limit its traffic.

After reading George Russs' e-mail message about tunneling through HTTP 
port, I tried to checked to see if the traffic is actually towards 
www.http-tunnel.com. I found out that the traffic is not towards their 
servers, but mostly towards the following ones. Has anyone experienced any 
such situation ? Does any one know what these IP's are ?

157.163.1.10 - 157.163.1.19 and
66.28.236.82 - 66.28.236.93

Regards.



Mustafa Cagatayli
CC

-++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**
This message was posted through the Stanford mailing list server. To
subscribe/unsubscribe, send email to majordomo@lists.stanford.edu
with "subscribe packeteer-edu" or "unsubscribe packeteer-edu" as the body.  Archive
is at http://www.stanford.edu/group/networking/netlists/