echo requests, 1480 bytes

[thomas () 88 NET (thomas lakofski)]

i've been seeing the following recently:

Feb  3 06:24:30 oi iplog[20316]: ICMP: echo from ns-norva.navy.mil (1480 bytes)
Feb  3 16:13:50 oi iplog[20316]: ICMP: echo from cismhp.univ-lyon1.fr (1480 bytes)
Feb  4 08:15:32 oi iplog[20316]: ICMP: echo from stone.gocis.bg (1480 bytes)
Feb  7 15:21:37 oi iplog[20316]: ICMP: echo from 209.213.81.134 (1480 bytes)
Feb  7 20:26:31 oi iplog[20316]: ICMP: echo from stone.gocis.bg (1480 bytes)
Feb  8 01:52:05 oi iplog[20316]: ICMP: echo from h00e0290a81ca.ne.mediaone.net (1480 bytes)
Feb  8 01:53:01 oi iplog[20316]: ICMP: echo from h00e0290a81ca.ne.mediaone.net (1480 bytes)
Feb  8 01:54:08 oi iplog[20316]: ICMP: echo from h00e0290a81ca.ne.mediaone.net (1480 bytes)
Feb  8 01:57:48 oi iplog[20316]: ICMP: echo from h00e0290a81ca.ne.mediaone.net (1480 bytes)
Feb  8 02:08:18 oi iplog[20316]: ICMP: echo from h00e0290a81ca.ne.mediaone.net (1480 bytes)
Feb  8 02:13:23 oi iplog[20316]: ICMP: echo from h00e0290a81ca.ne.mediaone.net (1480 bytes)
Feb  8 15:13:24 oi iplog[20316]: ICMP: echo from ns-norva.navy.mil (1480 bytes)

i thought these might be controlling packets for one of the dist'd DoS
tools -- can anybody confirm or deny?  my network blocks directed
broadcasts so i doubt that it's a smurf-type attack.

-tl

......
         who's watching your watchmen?
EF D8 33 68 B3 E3 E9 D2  C1 3E 51 22 8A AA 7B 98