Subject: [IPsec] Endless stream of NAT-T keepalive probes?

From: Paul Wouters <[email-masked]>
Date: Wed, 22 Jun 2016 12:11:08 -0400 (EDT)

Hi,

One of my machines is seeing a continous stream of NAT-T keepalive probes
for which we have no state (and for which we had no state for days or
weeks or ever). These always seem to come in sets of 3 probes at once,
every 20 seconds. And oddly enough on port 500, not 4500. Containing
the 1 byte 0xFF NAT-Keepalive payload.

Currently offending IPs are: 87.236.232.253, 46.34.71.246 and 64.115.92.187.

Small pcap entry attached.

Has oneone experienced these before? Is this a known bad device? Or am I
just special? :)

Paul

---

From: Yoav Nir <[email-masked]>
Date: Thu, 23 Jun 2016 00:53:10 +0300

All three devices also run an SSL-VPN, so you can just go to https://<addr> to see who owns them. 

The first one will also tell you the vendor as they didn’t customize the landing page…

> On 22 Jun 2016, at 7:11 PM, Paul Wouters <[email-masked]> wrote:
> 
> 
> Hi,
> 
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec