Full Disclosure mailing list archives
Re: Weird traffic
From: James Matthews <nytrokiss () gmail com>
Date: Wed, 25 Feb 2009 20:42:04 +0200
If you have a large paste can you please put it in a pastebin. On Wed, Feb 25, 2009 at 7:50 PM, julio sanchez <pete.sanches () gmail com>wrote:
No IDS alert yet. What alerted us was the constant ARP loop scan on various vista sp1 box while we was monitoring the network I'll send a pcap in one hour or twoThanks 2009/2/25 B Null <bnull () offenseindepth com>Can you provide a pcap with the suspect traffic isolated? Also, what alerted you to the odd behavior? Did the traffic flag an IDS alert? bNull On Wed, Feb 25, 2009 at 9:27 AM, julio sanchez <pete.sanches () gmail com>wrote:Hi, We're experiencing some weird arp traffic on our network, some box scan constantly the subnets with loop "who-has" request All the box are all windows vista sp1 fully patched. We did format all the supect box, and isolate them on a vlan, to reinstall vista, updates, kaspersky, then we put it back on the network, and still some ramdom freshly formated box scanning the network. We find out that Vista will do an arp scan when it search for a network printer, but it does this once. The problem we have is an almost permanent arp scan on various boxs. We know that some worm was hitting some network around the world with the smb vulnerability, but all of our boxs are fully updated. Have you experienced something like this before, or it seems to be legit traffic ? Can this be a worm or something related ? Thanks in advance Pete _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-- http://www.goldwatches.com/ http://www.jewelerslounge.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Weird traffic julio sanchez (Feb 25)
- Re: Weird traffic B Null (Feb 25)
- Re: Weird traffic julio sanchez (Feb 25)
- Re: Weird traffic James Matthews (Feb 25)
- Re: Weird traffic julio sanchez (Feb 26)
- Re: Weird traffic srl (Feb 26)
- Re: Weird traffic julio sanchez (Feb 26)
- Re: Weird traffic James Matthews (Feb 27)
- Re: Weird traffic julio sanchez (Feb 25)
- Re: Weird traffic B Null (Feb 25)