Re: ddos-stacheldraht server-spoof alerts ( Was: What is this?)

[Jacek Lipkowski <sq5bpf () ACID CH PW EDU PL>]

On Wed, 14 Feb 2001, Rod Longanilla wrote:

> I'm still watching and recording the alerts until it can be absolutely
> proven these particular alerts are just false positives.  So if anyone has
> further information what can possibly be generating these, please
> post/reply.

i'm also getting alot of packets with icmp id 666 (and others). most of
them have no payload. i've traced some of them to imesh (something similar
to napster - chech www.imesh.com). almost all packets are from dialups,
some of them come from unix boxes (but their ttl is one hop smaller than
the ttl of these boxes, so these are probably from machines behind these
boxes).

jacek