RE: [SOT Rant] Non-hostile probes / opt-in/out

[James Thomason <james () divide org>]

On Fri, 26 Oct 2001, Quibell, Marc wrote:

> LOL!
>
> I believe that the question should be: Why are you pinging me? Tell me what
> admin who sees thousands of ping from one host does not investigation the
> nature? Do mean to say that if you were to log thousands of pings, you would
> ignore them? 
>
> Also many ping attacks start with harmless ping probes.

The example you gave noted 2400 ICMP echo requests in a three hour
period.  On most systems I have worked with, the standard ping utility
sends ICMP echo requests at a rate of one per second.  This is 3600 echo
requests per hour, 10800 in a three hour period.  

In my experience,  is fairly common place to leave ping running for
extended periods of time to observe network performance and detect
intermittent problems.  

I would think this number of echo requests from a single host in such a
timeframe is hardly abnormal, and I could care less. 

Should I receive 10800 echo requests in less than a minute I could become
concerned, depending on the popularity of the system in question. 

> Marc 
>
>
> -----Original Message-----
> From: James Thomason [mailto:james () divide org]
> Sent: Friday, October 26, 2001 3:00 PM
> To: Patrick W. Gilmore
> Cc: nanog () merit edu; Quibell, Marc
> Subject: RE: [SOT Rant] Non-hostile probes / opt-in/out
>
>
> If I did, and they responded negatively, I would tell them YOU said it was
> a good idea.
>
> Seriously, why should the administrators of *.army.mil care if I test
> packet response time between our networks?  Is this an illegal activity I
> am unaware of?  
>
> On Fri, 26 Oct 2001, Patrick W. Gilmore wrote:
>
> > At 02:16 PM 10/26/2001 -0500, Quibell, Marc wrote:
> >  >
> >  >Maybe you should ping NS01.ARMY.MIL about 2400 times in 3 hour and see
> if
> >  >you don't get a visit? Pinging a website 2 times means nothing..
> >
> > How about 441 times in 2 hours? :)
> >
> >
> >  >Marc
> >
> > --
> > TTFN,
> > patrick