[Dshield] Ping Attack

Gearry Judkins Gearry_Judkins at mtvalleyhs.sad43.k12.me.us
Fri Aug 29 13:44:01 GMT 2003


"David McGaughey" <DMcGaughey at mail.ci.lubbock.tx.us> writes:
>I bet you've the Nachi version of the worm on one or more machines.  It
>uses ping packets with it's own payload.  We seen it bring fast,
>switched networks down here in Lubbock.
Perhaps I left out one piece of information.  I am seeing this from the
WAN side of the firewall and the packets are being dropped.  So, perhaps I
am infected and the return packets are not making it back to the infected
machine.  Or, perhaps someone else in our class B is infected and
attempting to spread into this network.  I guess what I need to do is
confirm that we are not infected and that the firewall is doing its job.

Gearry




More information about the list mailing list