Should I be worried?

[illusion88]

Details: Intrusion: Invalid ICMP Type.
Intruder: 222.130.20.105.
Risk Level: High.
Source IP address: 222.130.20.105.
Destination IP address: SUPERMAN(24.4.235.202).
ICMP Code: 94.
ICMP Type: 52. This ICMP Type is invalid.

This happened ysterday too, only from a different ip. Here is the whois on this ip. I knew Austrilla was up to no good.

OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU

ReferralServer: whois://whois.apnic.net

NetRange: 222.0.0.0 - 222.255.255.255
CIDR: 222.0.0.0/8
NetName: APNIC8
NetHandle: NET-222-0-0-0-1
Parent:
NetType: Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS4.APNIC.NET
NameServer: NS-SEC.RIPE.NET
NameServer: TINNIE.ARIN.NET
Comment: This IP address range is not registered in the ARIN database.
Comment: For details, refer to the APNIC Whois Database via
Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment: for the Asia Pacific region. APNIC does not operate networks
Comment: using this IP address range and is not able to investigate
Comment: spam or abuse reports relating to these addresses. For more
Comment: help, refer to http://www.apnic.net/info/faq/abuse
RegDate: 2003-02-13
Updated: 2005-05-20

OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3100
OrgTechEmail: search-apnic-not-arin@apnic.net

 

[nsafreak]

Script kiddies + their tools = lots of entries like these in IDS & firewall logs. I very much doubt it's anything to worry about. Probably some kiddie scanning a range of IP addresses to see if somebody was found vulnerable.

 

[JinLien]

Why would you wories, unless you have pooly config mail/web servers sitting outside of the firewall.