Can you identify this XLATE output? is it an attack?

[veneficuss]

On my PIX machine:
Output of show xlate

pixfirewall# sh xlate
211 in use, 211 most used
Global 208.168.40.141 Local 208.168.40.140
Global 208.168.40.140 Local 208.168.40.139
Global 208.168.40.143 Local 208.168.40.142
Global 208.168.40.142 Local 208.168.40.141
Global 208.168.40.137 Local 208.168.40.136
Global 208.168.40.136 Local 208.168.40.135
Global 208.168.40.139 Local 208.168.40.137
Global 208.168.40.138 Local 193.2.2.39
Global 208.168.40.133 Local 208.168.40.130
Global 208.168.40.132 Local 192.1.1.102
Global 208.168.40.135 Local 208.168.40.134
Global 208.168.40.134 Local 208.168.40.133
Global 208.168.40.129 Local 208.168.40.126
Global 208.168.40.128 Local 192.1.1.22
Global 208.168.40.131 Local 192.1.1.163
Global 208.168.40.130 Local 208.168.40.127
Global 208.168.40.157 Local 192.1.1.33
Global 208.168.40.156 Local 192.100.100.141
Global 208.168.40.159 Local 193.2.2.42
Global 208.168.40.158 Local 193.2.2.71
Global 208.168.40.153 Local 193.2.2.79
Global 208.168.40.152 Local 192.1.1.121
Global 208.168.40.155 Local 192.1.1.108
Global 208.168.40.154 Local 208.168.40.153
Global 208.168.40.149 Local 192.100.100.118
Global 208.168.40.148 Local 192.1.1.115
Global 208.168.40.151 Local 192.1.1.31
Global 208.168.40.150 Local 192.1.1.224
Global 208.168.40.145 Local 208.168.40.144
Global 208.168.40.144 Local 208.168.40.143
Global 208.168.40.147 Local 208.168.40.146
Global 208.168.40.146 Local 208.168.40.145
Global 208.168.40.173 Local 192.1.1.175
Global 208.168.40.172 Local 193.2.2.96
Global 208.168.40.175 Local 192.1.1.170
Global 208.168.40.174 Local 169.254.61.168
Global 208.168.40.169 Local 193.1.1.54
Global 208.168.40.168 Local 208.168.40.166
Global 208.168.40.171 Local 192.1.1.168
Global 208.168.40.170 Local 192.1.1.103
Global 208.168.40.165 Local 208.168.40.161
Global 208.168.40.164 Local 193.2.2.80
Global 208.168.40.167 Local 193.2.2.72
Global 208.168.40.166 Local 193.2.2.59
Global 208.168.40.161 Local 192.1.1.172
Global 208.168.40.160 Local 193.2.2.105
Global 208.168.40.163 Local 192.1.1.113
Global 208.168.40.162 Local 192.1.1.116
Global 208.168.40.189 Local 192.168.20.53
Global 208.168.40.188 Local 192.1.1.106
Global 208.168.40.191 Local 193.1.1.51
Global 208.168.40.190 Local 192.1.1.120
Global 208.168.40.185 Local 193.1.1.58
Global 208.168.40.184 Local 193.2.2.48
Global 208.168.40.187 Local 193.2.2.84

the list continues - does anyone recognize this pattern? It's driving me crazy!

Thanks in advance!
S. Kirsten veneficuss@aol.com

 

[phishe]

Is your public ip(s) part of this block?
__________________________________________
WHITE ROSE INC. NETBLK-CW-208-168-40-A
123 Frost Street
Westbury, NY 11590
US

Netname: CW-208-168-40-A
Netblock: 208.168.40.0 - 208.168.40.255

Coordinator:
O'Sullivan, John JO208-ARIN josul@whiterose.com
516-333-2040

Record last updated on 12-Feb-2000.
Database last updated on 17-Jun-2002 19:59:35 EDT.

The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and whois.nic.mil for NIPRNET Information.

 

[RonRS]

Send the output of a sh ip, sh glob, and a sh nat.

 

[veneficuss]

yes, that is our public IP. Do you notice how the local and the global seem to be "stepping up" on the 208 addresses? this is what is confusing and sometimes it takes all available slots and we must issue a cl xlate