Snort mailing list archives
RE: Increase in nmap pings
From: Frank Knobbe <frank () knobbe us>
Date: Mon, 03 May 2004 11:38:40 -0500
On Mon, 2004-05-03 at 10:17, Chuck Holley wrote:
I noticed some too. Not a whole lot but about a dozen. Out of france?
We seeing tons of these as well. I'm not sure which malware is responsible, but it looks like a worm and not like a decoy scan. The info about Sasser doesn't mention ICMP pings, but it is still a candidate. Perhaps a new Agobot variant that pings first? Regards, Frank
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Increase in nmap pings Michael Schwartzkopff (May 03)
- <Possible follow-ups>
- RE: Increase in nmap pings Miner, Jonathan W (May 03)
- RE: Increase in nmap pings Chuck Holley (May 03)
- RE: Increase in nmap pings Frank Knobbe (May 03)
- RE: Increase in nmap pings Chuck Holley (May 03)
- RE: Increase in nmap pings Miner, Jonathan W (May 03)
- RE: Increase in nmap pings Larry Pitcher (May 03)
- Re: Increase in nmap pings Michael Schwartzkopff (May 03)