Packets Found on an Internet

As part of our security measures, we spend a fair amount of time and effort looking for things that might otherwise be ignored. Apart from assorted attempted penetrations, we have also discovered many examples of anomalous behavior. These range from excessive ICMP messages to nominally-local broadcast packets that have reached us from around the world. 1 Introduction For security reasons, AT&T's connection to the Internet is via a pair of application gateways[Che90]. To maintain the security of the gateways, we monitor them for attempted intrusions[Che92]. Recently, we have also started looking for more inventive penetration attempts[Bel92b]. We have indeed found such behavior. While looking, though, we noticed a surprising amount of other anomalous behavior, packets that do not appear to indicate an attempted break-in, but are worthy of attention nevertheless. We are currently running three types of broad-spectrum monitors. First, a workstation with an Ethernet controller in "promisc..