End node administrators should be aware that some vendors will auto-configure and add this prefix to the nodes forwarding table. Since May 26 we have received more than 1800 broken packets from Ips corresponding to AOL servers. AOL characterizes this as normal web traffic and my faulty snort rules despite the fact that the reserved flag is set. AOL has been alternately patronizing and mute on the subject. I am including 31 instances of these events that are from AOL servers that are not from port 80.
Output is from snort prettied up some.
Fields are comma delimited. Post 36385 does not match any known port on my ports listing. I figure that since nmap has been ported to NT we will see more scans coming down the wire with strange options and flags. Still, it probably won't be long before someone fixes the NDIS interface elements of the code to allow it to work with RAS devices. 192.x.x.x is the internal address of our extranet server.