Re: DreamHost Contact?

>>> On 12/30/2007 at 8:27 PM, Gregory Hicks
<ghickscadence.com> wrote:

> 
>> Date: Sun, 30 Dec 2007 21:42:21 -0500
>> From: Michael Greb <mgreblinode.com>
>> To: nanogmerit.edu 
>> Subject: DreamHost Contact?
>> 
>> 
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> 
>> I've attempted to contact DreamHost NOC or Abuse
departments via
the
>> numbers in whois but just get voice mail and no
call back.
>> 
>> I've got a user sending a lot of UDP traffic to
208.113.189.13 port
22.
>> This traffic is very likely undesirable and I'd be
willing to pull
the
>> plug immediately if I can get confirmation from
DreamHost.  Failing
that
> 
> Port 22?  Isn't that ssh?  Doesn't ssh have the
capability to forward
X or 
> whatever via ssh?

SSH uses only TCP, not UDP. 22/udp traffic used to be
indicative of
old,
buggy PCAnywhere. PCAnywhere is supposed to use 5632/udp
(0x1600), but
there was an endian bug in some old versions that had it
using 0x0016,
22/udp.

Haven't seen that for a long time. May or may not have
anything to do
with
this traffic.

B¼information contained in this e-mail message is
confidential, intended
only for the use of the individual or entity named above. If
the reader
of this e-mail is not the intended recipient, or the
employee or agent
responsible to deliver it to the intended recipient, you are
hereby
notified that any review, dissemination, distribution or
copying of this
communication is strictly prohibited. If you have received
this e-mail
in error, please contact postmasterglobalstar.com