Security Incidents mailing list archives
RE: Odd windows ICMP... any ideas what this is?
From: "Eugene Borukhovich" <eugene.b () macroscape com>
Date: Mon, 9 Jun 2003 22:59:24 -0400
Take a look at this. Haven't tested this myself though: http://www.wfu.edu/~stein/work/icmp.html
-----Original Message----- From: ted klugman [mailto:tedklugman () yahoo com] Sent: Monday, June 09, 2003 12:05 PM To: incidents () securityfocus com Subject: Odd windows ICMP... any ideas what this is? Our IDS has been reporting some large ICMP packets on our internal network. Our internal network is a Windows2000 domain -- servers and clients. - Packet size is always 2090 bytes - Almost always sent from a client or member server to one of the two boxes running Active Directory - The ping payload itself is actually a JPEG of the Microsoft logo. This JPEG can actually be found inside userenv.dll. I googled for any details, and I see that others have run into this before. However, there were no answers, just questions. See these two links for identical packets: http://archives.neohapsis.com/archives/linux/debian/2002-q4/0658.html
http://cert.uni-stuttgart.de/archive/debian/security/2002/11/msg00222.ht ml
Anyone else seen these? Any idea what's causing them? Is this 'normal' behavior on a W2K network? Other than the fact that they are relatively large ICMP packets, they don't appear to be malicious in any way. There is no other malicious traffic seen on our network. TIA. -TedK __________________________________ Do you Yahoo!? Yahoo! Calendar - Free online calendar with sync to Outlook(TM). http://calendar.yahoo.com
------------------------------------------------------------------------ --
--
------------------------------------------------------------------------ --
--
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- Odd windows ICMP... any ideas what this is? ted klugman (Jun 09)
- Re: Odd windows ICMP... any ideas what this is? Ryan Yagatich (Jun 10)
- Re: Odd windows ICMP... any ideas what this is? Raistlin (Jun 16)
- Re: Odd windows ICMP... any ideas what this is? Mika Boström (Jun 10)
- RE: Odd windows ICMP... any ideas what this is? Eugene Borukhovich (Jun 10)
- <Possible follow-ups>
- Re: Odd windows ICMP... any ideas what this is? Jonathan Clark (Jun 10)
- Re: Odd windows ICMP... any ideas what this is? Ryan Yagatich (Jun 10)