Incident: 03-12-02 tcp:53


snort2html.plx:

Mar 12 23:28:22 - snort [1:0:0] TCP to 53 domain 
  Source IP: 202.237.14.185   Source port: 4080 
Source host: ginza.ne.jp
  Target IP: 12.82.141.8   Target port: 53   Proto: TCP 
Target host: 8.seattle-15-20rs.wa.dial-access.att.net


snort packet dump:

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
[**] [1:0:0] TCP to 53 domain [**]
03/12-23:28:22.700060 202.237.14.185:4080 -> 12.82.141.8:53
TCP TTL:51 TOS:0x0 ID:21839 IpLen:20 DgmLen:60 DF
******S* Seq: 0xEFBE062C  Ack: 0x0  Win: 0x7D78  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 17578046 0 NOP WS: 0

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


BW whois 2.9 by Bill Weinman (http://whois.bw.org/)
 1999-2001 William E. Weinman 

Request: 202.237.14.185
connecting to whois.arin.net [63.146.182.182:43] ...
connecting to WHOIS.APNIC.NET [202.12.29.13:43] ... 

% Rights restricted by copyright. See http://www.apnic.net/db/dbcopyright.html
% (whois6.apnic.net) 

inetnum:     202.236.0.0 - 202.239.255.255
netname:     JPNIC-NET-JP
descr:       Japan Network Information Center
country:     JP
admin-c:     JNIC1-AP
tech-c:      JNIC1-AP
remarks:     JPNIC Allocation Block
remarks:     Authoritative information regarding assignments and
remarks:     allocations made from within this block can also be
remarks:     queried at whois.nic.ad.jp. To obtain an English
remarks:     output query whois -h whois.nic.ad.jp x.x.x.x/e



[ JPNIC database provides information on network administration. Its use is   ]
[ restricted to network administration purposes. For further information, use ]
[ 'whois -h whois.nic.ad.jp help'. To suppress Japanese output, add '/e' at   ]
[ the end of command, e.g. 'whois -h whois.nic.ad.jp xxx/e'.                  ] 

Network Information:
a. [Network Number]             202.237.14.0
b. [Network Name]               AMR-NET
g. [Organization]               AMR Inc.
m. [Administrative Contact]     SK114JP
n. [Technical Contact]          IN012JP
p. [Nameserver]                 ns.amr.co.jp
p. [Nameserver]                 ns.hmd.co.jp
y. [Reply Mail]                 KGE02170@niftyserve.or.jp
[Assigned Date]                 
[Return Date]                   
[Last Update]                   1997/07/08 22:25:07 (JST)
                                koh@amr.co.jp



http to 202.237.14.185:

<html><body>GINZA.NE.JP</body></html>


jsage@finchhaven.com
Last modified: Sat Mar 16 14:15:03 2002