Re: [nznog] High volumes of ICMP echo request (type 8)

Ewen McNeill writes:

Hi,

Is anyone else seeing very high volumes of ICMP echo requests today (ie, in the order of hundreds/thousands per second)?

At one client I've been seeing in the order of 2000+ ICMP echo requests per minute from each of four different desktops (desktop support is tracking down the relevant desktops now) to IP addresses all over the net.

And snooping on Citylink (which is implemented as a big LAN) shows much-higher-than-I'd-normally-expect volumes of ICMP echo requests flying around from all sorts of random addresses to all sorts of other random addresses.

Welchia used pings, not Blaster.A IIRC. I've seen Welchia at around 180 packets/second on a LAN and it seems to do a strictly linear scan, so it doesn't sound like that either. What do the ping packets look like? cheers, Jamie -- James Riden / j.riden(a)massey.ac.nz / Systems Programmer - Security Information Technology Services, Massey University, NZ. GPG public key available at: http://www.massey.ac.nz/~jriden/