Re: echo requests, 1480 bytes

[rgula () SECURITYWIZARDS COM (Ron Gula)]

> > Thomas,
> >
> > What catches my eye in your message is:
> >
> > > Feb  3 06:24:30 oi iplog[20316]: ICMP: echo from ns-norva.navy.mil (1480
> bytes)
> > Does anyone know what these folks are up to?  I usually see an echo
> > request from them, followed by an ICMP source quench.  Very odd.
> >
> > Don

We have seen several sites monitored by the Dragon IDS pick up this
packet. It is spooed as certain fields in the ICMP and IP headers
never change. Someone probably compiled an ICMP spoofer and used a
the length of their buffer as the length of their packet.

I'd post a copy of the packet, but I don't have permission from the
customer at the moment. It's a payload of all zeros after the ICMP
header.

Ron Gula, CTO.
Network Security Wizards, Inc.
http://www.securitywizards.com