Re: a lot of spoofed traffic for port 8, does anybody recon this?

From: Devdas Bhagat (devdasat_private)
Date: Mon May 14 2001 - 10:04:48 PDT

Next message: Matt Rowley: "RE: who's owning this ip?"

Previous message: H D Moore: "Re: linux hack"
In reply to: Bob Johnson: "Re: a lot of spoofed traffic for port 8, does anybody recon this?"
Next in thread: Kevin Pietersma: "Re: a lot of spoofed traffic for port 8, does anybody recon this?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Mon, 14 May 2001, Bob Johnson spewed into the ether:
> port 8 on the client system (i.e. the system it is connecting to the 
This is ICMP! There is no concept of ports in ICMP. The 8 reefers to
the type of ICMP message.
Type 8 is ICMP_ECHO, type 0 is ICMP_ECHOREPLY.
Someone/something pinging the modem to see if its alive, maybe?

> In his case the modem has a public IP number, so the probe packets come 
> from that address.
192.168/16 is RFC 1918 space, not public IP space.

Devdas Bhagat

Next message: Matt Rowley: "RE: who's owning this ip?"
Previous message: H D Moore: "Re: linux hack"
In reply to: Bob Johnson: "Re: a lot of spoofed traffic for port 8, does anybody recon this?"
Next in thread: Kevin Pietersma: "Re: a lot of spoofed traffic for port 8, does anybody recon this?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon May 14 2001 - 11:49:02 PDT