smurf scanning

[jlewis () LEWIS ORG (Jon Lewis)]

I was scanning through some firewall logs for a client this weekend and
noticed 40 scans in the past week for either 8/0/icmp x.y.z.0 or 8/0/icmp
x.y.z.255 (they have a T1 to the net and a single /24).  Alot of the scans
came from dialups in Italy or the UK.  A few were hacked Linux boxes (one
in the US, one in Italy, one in Korea).  I guess the people who use smurf
have to continually hunt for networks appropriate for smurf
amplification...but I didn't realize they were this actively scanning the
net.

Also present in the logs were people scanning the entire /24 for dns
servers, and other less common protocols.  Are others seeing/noticing
similar things?

----------------------------------------------------------------------
 Jon Lewis *jlewis () lewis org*|  Spammers will be winnuked or
 System Administrator        |  nestea'd...whatever it takes
 Atlantic Net                |  to get the job done.
_________http://www.lewis.org/~jlewis/pgp for PGP public key__________