Full Disclosure mailing list archives
Re: Worm side effects
From: malware () t-online de (Michael Mueller)
Date: Tue, 26 Aug 2003 02:32:31 +0200
Hi Geoincidents, you wrote:
AFAIK, the worm uses a standard Windows routine to generate those ICMP packets.Nope, normal NT ping generates a 60 byte packet not 92 byte.
You still can be both right ;-) The standard Windows routine as of Windows 2000 does allow sending ICMP echo requests with an arbitary length, see http://msdn.microsoft.com/library/default.asp?url=/library/en-us/iphlp/iphlp/icmpsendecho.asp Yes, and the worm does use it to send 92 byte ICMP echo-request packets. Michael -- Linux@TekXpress http://www-users.rwth-aachen.de/Michael.Mueller4/tekxp/tekxp.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: JAP back doored, (continued)
- RE: JAP back doored Drew Copley (Aug 22)
- Re: JAP back doored Florian Weimer (Aug 22)
- Re: JAP back doored felix . roennebeck (Aug 25)
- Re: JAP back doored morning_wood (Aug 25)
- Re: JAP back doored felix . roennebeck (Aug 25)
- Re: JAP back doored morning_wood (Aug 25)
- RE: JAP back doored Jeroen Massar (Aug 25)
- Worm side effects Geo. (Aug 25)
- Re: Worm side effects Florian Weimer (Aug 25)
- Re: Worm side effects Geoincidents (Aug 25)
- Re: Worm side effects Michael Mueller (Aug 25)
- Re: JAP back doored felix . roennebeck (Aug 26)
- Re: JAP back doored Sebastian Niehaus (Aug 22)
- Re: JAP back doored Florian Weimer (Aug 22)
- Re: JAP back doored Azerail (Aug 22)
- Re: JAP back doored felix . roennebeck (Aug 22)
- Re: JAP back doored Azerail (Aug 22)
- Re: JAP back doored felix . roennebeck (Aug 25)