[Dshield] Ping Attack
Gearry_Judkins at mtvalleyhs.sad43.k12.me.us
Fri Aug 29 13:44:01 GMT 2003
"David McGaughey" <DMcGaughey at mail.ci.lubbock.tx.us> writes:
>I bet you've the Nachi version of the worm on one or more machines. It
>uses ping packets with it's own payload. We seen it bring fast,
>switched networks down here in Lubbock.
Perhaps I left out one piece of information. I am seeing this from the
WAN side of the firewall and the packets are being dropped. So, perhaps I
am infected and the return packets are not making it back to the infected
machine. Or, perhaps someone else in our class B is infected and
attempting to spread into this network. I guess what I need to do is
confirm that we are not infected and that the firewall is doing its job.
More information about the list