Re: Urgent: Welchi/Nachi worm and ICMP

[Doug Pearson <dodpears () INDIANA EDU>]

The 92 byte information was provided to REN-ISAC by Abilene
network engineers. The Cisco Security Notice forwarded by Ken
bears this out.

The attached graph shows the dramatic increase in aggregate
ICMP echo reply traffic on Abilene. We don't have information
that directly ties the increase to Welchia/Nachi... it's possible
that something else was going on... but certainly some
attribution to Welchia/Nachi can be made.

Doug Pearson
REN-ISAC, Acting Director
Indiana University
ren-isac () iu edu



At 03:42 PM 8/19/2003 -0700, you wrote:
> Could you tell us where you got the "packet size of 92 bytes" information
> from?
>
> Thanks,
> scott
>
>
>
> On Tue, 19 Aug 2003, Doug Pearson wrote:
>
> :  Reports have come in that blocking all ICMP breaks Microsoft ADS.
> :  Anyone contemplating applying ICMP filters should take that into
> :  consideration. Blocking ICMP requests with a packet size of 92 bytes
> :  effectively blocks the Welchia/Nacho, and lets ADS live.
> :
> :  Doug Pearson
> :
> :
> :  >Several universities have reported that the Welchia, aka Nachi[1], worm is
> :  >generating very significant ICMP echo request traffic on internal and external
> :  >networks. Reports of serious network degradation due to the levels of ICMP
> :  >traffic have been received. Some universities report taking temporary measures
> :  >to block all internal, outbound, and inbound ICMP.
> :  >
> :  >[1] http://isc.sans.org/diary.html?date=2003-08-18
> :  >
> :  >Doug Pearson
> :  >REN-ISAC, Acting Director
> :  >Indiana University
> :  >ren-isac () iu edu
> :
> :  **********
> :  Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
> http://www.educause.edu/cg/.
> :
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
> http://www.educause.edu/cg/.

----
Doug Pearson; Indiana University; dodpears () indiana edu
Phone: 812-855-3846; ViDeNet: 0018128553846
PGP: http://mypage.iu.edu/~dodpears/dodpears_pubkey.asc

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.

Attachment: abilene_aggregate_icmp_030820_1300.pdf
Description: