Yep heaps here. It's like they sync'd because I get bursts of 20 or 30 per
second, then just a few for a few seconds, then bursts again :/
Barry
----- Original Message -----
From: "Ewen McNeill"
Hi,
Is anyone else seeing very high volumes of ICMP echo requests today (ie, in the order of hundreds/thousands per second)?
At one client I've been seeing in the order of 2000+ ICMP echo requests per minute from each of four different desktops (desktop support is tracking down the relevant desktops now) to IP addresses all over the net.
And snooping on Citylink (which is implemented as a big LAN) shows much-higher-than-I'd-normally-expect volumes of ICMP echo requests flying around from all sorts of random addresses to all sorts of other random addresses.
I'm aware that some worms use this as part of their probing/spreading (eg, MS Blaster) but not of any newly released worm (or worm due to make a comeback at present), so I'm a bit puzzled at it's "sudden" appearance.
Ewen _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog