Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Strange ICMP NAT translations viewed

I have placed our general DSL customers behind NAT, and I'm seeing these odd NAT entries:

Anyone explain these entries?

Router# show ip nat translations icmp

Pro Inside global Inside local Outside local Outside global

icmp 208.144.173.22:1440928569 10.0.4.16:1440928569 61.180.228.244:1 61.180.228.244:1

icmp 208.144.173.23:406009992 10.0.4.35:406009992 61.180.228.244:1 61.180.228.244:1

icmp 208.144.173.3:0 10.0.4.52:0 24.182.116.95:0 24.182.116.95:0

icmp 208.144.173.3:0 10.0.4.52:0 68.81.122.8:0 68.81.122.8:0

icmp 208.144.173.3:0 10.0.4.52:0 69.63.59.233:0 69.63.59.233:0

icmp 208.144.173.3:0 10.0.4.52:0 75.38.14.208:0 75.38.14.208:0

icmp 208.144.173.3:0 10.0.4.52:0 130.81.11.62:0 130.81.11.62:0

icmp 208.144.173.3:16 10.0.4.52:16 69.63.59.233:1647826488 69.63.59.233:1647826488

icmp 208.144.173.3:2924 10.0.4.52:2924 130.81.11.62:1611021764 130.81.11.62:1611021764

icmp 208.144.173.3:27302 10.0.4.52:27302 67.49.79.45:60023 67.49.79.45:60023

icmp 208.144.173.3:27302 10.0.4.52:27302 69.232.71.12:2917 69.232.71.12:2917

icmp 208.144.173.3:27302 10.0.4.52:27302 85.176.78.57:2437 85.176.78.57:2437

icmp 208.144.173.3:50496 10.0.4.52:50496 61.180.228.244:80 61.180.228.244:80

icmp 208.144.173.3:50496 10.0.4.52:50496 83.81.50.164:80 83.81.50.164:80

icmp 208.144.173.3:100663296 10.0.4.52:100663296 24.182.116.95:1611021764 24.182.116.95:1611021764

icmp 208.144.173.3:100663296 10.0.4.52:100663296 68.81.122.8:1611021764 68.81.122.8:1611021764

icmp 208.144.173.3:285212672 10.0.4.52:285212672 75.38.14.208:1611021764 75.38.14.208:1611021764

icmp 208.144.173.3:406176159 10.0.4.52:406176159 62.56.83.115:1 62.56.83.115:1

icmp 208.144.173.3:411342713 10.0.4.52:411342713 24.36.73.16:1 24.36.73.16:1

icmp 208.144.173.3:1064237900 10.0.4.52:1064237900 63.110.251.76:1 63.110.251.76:1

icmp 208.144.173.3:1090178942 10.0.4.52:1090178942 71.11.157.250:1 71.11.157.250:1

icmp 208.144.173.3:1191943674 10.0.4.52:1191943674 72.141.140.216:1 72.141.140.216:1

icmp 208.144.173.3:1192133725 10.0.4.52:1192133725 67.81.161.120:1 67.81.161.120:1

icmp 208.144.173.3:1357900811 10.0.4.52:1357900811 69.222.94.49:1 69.222.94.49:1

icmp 208.144.173.3:1357900811 10.0.4.52:1357900811 203.206.245.204:1 203.206.245.204:1

icmp 208.144.173.3:3629546038 10.0.4.52:3629546038 65.3.140.73:1 65.3.140.73:1

icmp 208.144.173.17:1191 10.0.4.68:1191 200.89.38.95:8001 200.89.38.95:8001

icmp 208.144.173.17:2924 10.0.4.68:2924 88.104.120.43:80 88.104.120.43:80

icmp 208.144.173.17:2927 10.0.4.68:2927 200.89.38.95:80 200.89.38.95:80

icmp 208.144.173.17:50000 10.0.4.68:50000 71.146.64.165:4650 71.146.64.165:4650

icmp 208.144.173.17:50000 10.0.4.68:50000 81.230.98.22:63598 81.230.98.22:63598

icmp 208.144.173.17:50000 10.0.4.68:50000 82.103.217.171:3469 82.103.217.171:3469

icmp 208.144.173.17:50000 10.0.4.68:50000 83.18.144.50:4263 83.18.144.50:4263

icmp 208.144.173.17:50000 10.0.4.68:50000 83.22.30.231:2049 83.22.30.231:2049

icmp 208.144.173.17:50000 10.0.4.68:50000 83.226.126.223:3137 83.226.126.223:3137

icmp 208.144.173.17:50000 10.0.4.68:50000 84.81.36.151:15010 84.81.36.151:15010

icmp 208.144.173.17:50000 10.0.4.68:50000 87.11.81.207:33473 87.11.81.207:33473

icmp 208.144.173.17:50000 10.0.4.68:50000 89.168.24.202:35454 89.168.24.202:35454

icmp 208.144.173.17:50000 10.0.4.68:50000 213.29.8.66:64533 213.29.8.66:64533

icmp 208.144.173.17:50496 10.0.4.68:50496 200.50.72.156:80 200.50.72.156:80

icmp 208.144.173.17:50502 10.0.4.68:50502 87.11.81.207:80 87.11.81.207:80

icmp 208.144.173.17:50537 10.0.4.68:50537 83.18.144.50:80 83.18.144.50:80

1 REPLY
Silver

Re: Strange ICMP NAT translations viewed

I susupect the host is infected by virus or using an application with such behavior. Why not contact the user and check w/ them ?

113
Views
0
Helpful
1
Replies