Re: [nznog] Not a virus - Windows 2000 PC's auto generating icmp packetfloods

Hi Tikiri, Are you able to dump a packet. Most worms etc. have a identifing stream. i.e. Nachi had hex 'a'. Cheers Steve. ----- Original Message ----- From: "Tikiri Wicks" To: Sent: Wednesday, October 22, 2003 11:15 PM Subject: [nznog] Not a virus - Windows 2000 PC's auto generating icmp packetfloods

Thanks for the feedback so far but it's not viruses.

Virus checks turned up nothing and it's definitely not the blaster virusas all the machines were patched for that when it came out. I've used both Norton as well as F-Secure to check the PC's but nothing turns up There is nothing special about these PC's either. Standard build of windows 2000 and most probably installed from the same disk set. Master Browser discovery ??? but that I thought was netbios

Still hunting :-(

----- Original Message ----- From: "Tikiri Wicks" To: Sent: Wednesday, October 22, 2003 10:47 PM Subject: [nznog] Windows 2000 PC's auto generating icmp packet floods

...

Hi

Just wondering if anyone can shed some light on this. 13 PC's in a network of about 300 PC's keep incrementally pinging everything in their netmask

For example PC with IP 172.20.10.2 will start pinging 172.20.10.1 and ping all the way upto 172.20.10.255. Then it starts over These are all windows 2000 machines and each one is generating about a hundred icmp packets per second incrementally counting through every destination IP in their netmask. If I change one of the machines netmask to /16 then it starts pinging everything in that entire class b starting at 1.1 and incrementally counting upto the top. These are all normal windows 2000 PC's

Does anyone have an idea on this ???

Cheers

Tikiri

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

-- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.