Educause Security Discussion mailing list archives
Re: Urgent: Welchi/Nachi worm and ICMP
From: Doug Pearson <dodpears () INDIANA EDU>
Date: Wed, 20 Aug 2003 08:49:20 -0500
The 92 byte information was provided to REN-ISAC by Abilene network engineers. The Cisco Security Notice forwarded by Ken bears this out. The attached graph shows the dramatic increase in aggregate ICMP echo reply traffic on Abilene. We don't have information that directly ties the increase to Welchia/Nachi... it's possible that something else was going on... but certainly some attribution to Welchia/Nachi can be made. Doug Pearson REN-ISAC, Acting Director Indiana University ren-isac () iu edu At 03:42 PM 8/19/2003 -0700, you wrote:
Could you tell us where you got the "packet size of 92 bytes" information from? Thanks, scott On Tue, 19 Aug 2003, Doug Pearson wrote: : Reports have come in that blocking all ICMP breaks Microsoft ADS. : Anyone contemplating applying ICMP filters should take that into : consideration. Blocking ICMP requests with a packet size of 92 bytes : effectively blocks the Welchia/Nacho, and lets ADS live. : : Doug Pearson : : : >Several universities have reported that the Welchia, aka Nachi[1], worm is : >generating very significant ICMP echo request traffic on internal and external : >networks. Reports of serious network degradation due to the levels of ICMP : >traffic have been received. Some universities report taking temporary measures : >to block all internal, outbound, and inbound ICMP. : > : >[1] http://isc.sans.org/diary.html?date=2003-08-18 : > : >Doug Pearson : >REN-ISAC, Acting Director : >Indiana University : >ren-isac () iu edu : : ********** : Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/cg/. : ********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/cg/.
---- Doug Pearson; Indiana University; dodpears () indiana edu Phone: 812-855-3846; ViDeNet: 0018128553846 PGP: http://mypage.iu.edu/~dodpears/dodpears_pubkey.asc ********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/cg/.
Attachment:
abilene_aggregate_icmp_030820_1300.pdf
Description:
Current thread:
- Urgent: Welchi/Nachi worm and ICMP Doug Pearson (Aug 19)
- <Possible follow-ups>
- Urgent: Welchi/Nachi worm and ICMP Doug Pearson (Aug 19)
- Re: Urgent: Welchi/Nachi worm and ICMP Scott Weeks (Aug 19)
- Re: Urgent: Welchi/Nachi worm and ICMP Theresa M Rowe (Aug 19)
- Re: Urgent: Welchi/Nachi worm and ICMP Doug Pearson (Aug 20)