[Dshield] icmp w/payload EEEEEEE

Pierre Lewis lew001 at globetrotter.net
Wed Jan 14 19:39:07 GMT 2004


On Wed, Jan 14, 2004 at 11:31:25AM -0800, Mrcorp wrote:

> Sorry if this has been commeted on, but I noticed the MAC
> addresses are the same for both groups, yet there are different
> IP addresses. So obviously some spoofing, which would mean that
> the response is not required from these pings???

They should be the same MAC addresses, shouldn't they? One is my
firewall's MAC address, other is cable router's MAC address.

> Also a low TTL.

Indeed, hadn't noticed! And not quite same in the two groups.

Cheers,
Pierre




More information about the list mailing list