Re: echo requests, 1480 bytes

[9d () COSMOSDIREKT DE (Fengor Wolfsclaw)]

Mixmaster schrieb:

> Big echo packets like this going out of our network set off our IDS
> sniffer here.  It turns out they were coming from Macintosh PC's, with
> one big echo request sent to a web server at the same time they opened
> an HTTP connection.  The payload was always all 0's.  We checked a
> couple of the Macs doing it and they had not been compromised, and the
> users weren't doing anything to cause it, so I'm guessing it's some kind
> of MTU discovery "feature" of MacOS.

wasn'T there a mail about something called "the mac attack" some time ago on bugtraq?
iirc it was an ddos attack that used these echo packets to multiply their traffic.

Daniel "Fengor" Brachmann