[Dshield] Welchia question

Johannes B. Ullrich jullrich at sans.org
Thu Aug 21 22:33:22 GMT 2003

On Thu, 2003-08-21 at 17:42, Porter, Richard USA wrote:
>             All,
>             Has anyone seen Welchia infected host or any of its variants
> start ping flooding?

oh yes. Welchia is sending pings as fast as it can. 94 Bytes each,
payload is all 0xAA

SANS - Internet Storm Center
PGP Key: http://isc.sans.org/jullrich.txt
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20030821/a101ca60/attachment.bin

More information about the list mailing list