Full Disclosure mailing list archives
RE: Increased TCP 139 Activity
From: "Choe.Sung Cont. PACAF CSS/SCHP" <Sung.Choe () hickam af mil>
Date: Fri, 10 Oct 2003 12:51:08 -0000
Ron Dufresne wrote:
If this is indeed the case, the ping sweep will all be packets of 92 byte, these are windows packets, and the recent rcpdcom sploits are the culprit.
ICMP packets 92-bytes in size (72 bytes + 20 bytes for header) are usually due to a welchia infected host trying to propagate. It is not a rpcdcom exploit. V/r, Sung J. Choe PACAF CSS/SCHP, PACAF NOSC Information Assurance Analyst DSN: 315-449-4317, Comm: 808-449-4317 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Increased TCP 139 Activity Phathat (Oct 08)
- <Possible follow-ups>
- RE: Increased TCP 139 Activity Williams Jon (Oct 08)
- RE: Increased TCP 139 Activity Brown, Rodrick (Oct 08)
- RE: Increased TCP 139 Activity Ron DuFresne (Oct 08)
- Re: Increased TCP 139 Activity Valdis . Kletnieks (Oct 09)
- RE: Increased TCP 139 Activity Marc (Oct 09)
- RE: Increased TCP 139 Activity Choe.Sung Cont. PACAF CSS/SCHP (Oct 10)
- Re: RE: Increased TCP 139 Activity Andrew Simmons (Oct 10)