Re: Unknown ICMP traffic

[Pete Hoffswell <Pete.Hoffswell () DAVENPORT EDU>]

We don't do anything in particular for this, but have not identified it as an issue either.

I would suggest blocking outbound traffic with a destination of 207.26.131.137.  That way, you can conserve your 
Internet bandwith.

Good luck!



Pete Hoffswell                                            616-732-1101 (Grand Rapids, x1101)
University LAN/WAN Coordinator                 616-395-4679 (Holland, x4679)
IT Services                                                 616-510-1198 (Mobile)
Davenport University                                   pete.hoffswell () davenport edu

http://www.davenport.edu                         http://www.davenport.edu/du/facultyandstaff/itservices/lanwan

 -=-=-  Check out DU WiFi services - http://www.davenport.edu/du/currentstudents/wifi -=-=-


> > > jkbarros () GRACE EDU 11/26/03 08:27AM >>>

Thanks for the info Pete and Brian.  

Do either of you, or anyone else, require students to disable the service or apply the referenced patch?  I haven't 
been monitoring long enough to know but is this really that big a deal? Is 20MB per hour a number that we can 
anticipate being a small campus (900 connections, 1300 users)?  Any comments would be helpful.

I apologize if this is a repeat thread.  I haven't been on the list for very long.

Jake Barros

-----Original Message-----
From: Brian K. Wheeler [mailto:BWheeler () UWYO EDU] 
Sent: Tuesday, November 25, 2003 4:46 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Unknown ICMP traffic


http://www.xtramsn.com/technology/0%2C%2C7003-2105448%2C00.html

Brian

-----Original Message-----
From: Barros, Jacob [mailto:jkbarros () GRACE EDU] 
Sent: Tuesday, November 25, 2003 2:43 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Unknown ICMP traffic


Can anyone tell me why I have more than a handful of machines sending ICMP requests to 207.26.131.137?  All computers 
displaying this behavior seem to be student computers running WindowsME.  Anyone seen this before? Should I be 
concerned?
********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found 
at http://www.educause.edu/cg/. ********** Participation and subscription information for this EDUCAUSE Discussion 
Group discussion list can be found at http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.