Mozilla "Route Optimization Probe" scan in firewall logs

Soldato
Joined
18 Aug 2007
Posts
9,915
Location
Liverpool
I wasn't sure quite where to put this tbh, but here seems about the best place overall. Despite the Linux-heavy info this IS a network/traceroute question and would have applied just as much had I happened to be in Windows running "random firewall X" at the time.

I'm currently in Linux (kernel 2.6.31-19-SMP x64) and am running Firestarter as a GUI for iptables firewall. I put my PC in the DMZ on the router last night to have a play around with the firewall (it's a clean Linux install remember, nothing to worry about) and left it at that. Shieldsup! from GRC reports that I'm 100% stealthed, my policy is whitelist only for in AND outbound, and I am set to silently drop WAN ping requests; so I'm pretty locked down.

When I logged on this morning I had lots of interesting hits from all over the place, mostly worms and bots randomly scanning out port 445 for vulnerable Microsoft-DS services. However, I had a significant number of traceroute entries from an IP (63.245.208.11) that resolves to route-optimization-probe.sj.mozilla.com.

mozilla-tracert.png


Has anyone ever seen/heard this before? Google provides a few people as confused/curious as I am, but no answers that I can see. Does anyone know what this is all about? Seems weird that Mozilla would go randomly banging on people's door so to speak, with traceroutes. :confused:
 
Back
Top Bottom