Re: Unusual ICMP Traffic

From: Gary Flynn (flynngnat_private)
Date: Tue Oct 22 2002 - 18:59:38 PDT

Next message: Griff Palmer: "Slapper questions"

Previous message: Brett Glass: "Re: Unusual ICMP Traffic"
In reply to: jeffat_private: "Unusual ICMP Traffic"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

jeffat_private wrote:

>Has anyone seen this type of ICMP traffic?
>

No, but I'm going to start looking ASAP. A google search on revconnecttome
turned up some interesting hits:

From:
http://www.lwave.ca/DCHub/protocol.html

    $RevConnectToMe

A passive client may send this to cause a peer to send a $ConnectToMe back.

    $RevConnectToMe <nick> <remoteNick> 

    * <nick> is the sender of the message.
    * <remoteNick> is the user which should send to $ConnectToMe.

The server must send this message unmodified to <remoteNick>. If 
<remoteNick> is an active client, it must send a $ConnectToMe to <nick>. 
If not, it must ignore the message.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Griff Palmer: "Slapper questions"
Previous message: Brett Glass: "Re: Unusual ICMP Traffic"
In reply to: jeffat_private: "Unusual ICMP Traffic"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Oct 22 2002 - 20:20:04 PDT