[Dshield] ping DoS?

Wayne Beckham wbeckham at yahoo.com
Mon Aug 18 18:16:02 GMT 2003


Detail from Symantec - 
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

- Wayne

--- Shawn Cox <shawn.cox at pcca.com> wrote:
> It is a new worm,  This one actually patches
> machines.
> W32.Welchia.worm (NAV)
> WORM_MSBLAST.D (Trend)
> 
> 
> --Shawn
> 
> ----- Original Message ----- 
> From: "Matthew Harrell" <mhar at plex.com>
> To: "Dshield Mailing List" <list at dshield.org>
> Sent: Monday, August 18, 2003 11:47 AM
> Subject: [Dshield] ping DoS?
> 
> 
> > At about 12:15 PM today, our internal WAN
> (includes multiple customers on
> > their own subnets) seems to have been hit by some
> kind of ping DoS worm.
> > In my firewall logs, I saw HUGE amounts of pings
> coming from multiple
> hosts
> > in all (or at least most) of our internal subnets.
>  The pings seem to
> > target nearby subnets (192.168.x.x, and some
> 192.165.x.x are what I saw
> > most of).  We are running Symantec Enterprise
> Firewall, which has a ping
> > proxy.  This proxy on both firewalls was
> overwhelmed, and this resulted in
> > a practical DoS on our ASP servers.  I added a
> ping deny filter on the
> > internal interfaces on our firewalls, and things
> are accessible now, but
> > we're still working on tracing down these pings. 
> Does anyone know of a
> > worm, or anything else, that would do this?
> >
> >
> > -----------------
> > Matt Harrell
> > Plexus Systems
> > mhar at plex.com
> > _______________________________________________
> > list mailing list
> > list at dshield.org
> > To change your subscription options (or
> unsubscribe), see:
> http://www.dshield.org/mailman/listinfo/list
> >
> 
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or
> unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list


__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com




More information about the list mailing list