Security Incidents mailing list archives
Fragmented UDP and Multicast Addresses
From: "Chris Martin" <chris () mainstreethost com>
Date: Tue, 15 Nov 2005 14:29:09 -0500
Hello list, Today at work we found some very strange behavior on one of our servers. This machine was spitting out several thousand fragmented UDP packets to an IP multicast address. The rate of packet sending was quite high, using ethereal for about 10 minutes showed that of approximately 75,000 packets, almost 70,000 of them where these fragmented UDP packets. They were being sent to a 239.192.*.* which according to RFC 3171 is an Administratively Scoped Block of IPv4 Multicast. This really has us scratching our heads. I was wondering if anyone here had seen this kind of behavior before, or had any ideas as to what it could possibly be? Thanks, Christopher S Martin
Current thread:
- Fragmented UDP and Multicast Addresses Chris Martin (Nov 15)
- Re: Fragmented UDP and Multicast Addresses Barrie Dempster (Nov 16)