[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: icmp: echo reply? Am I being attacked?

John Vivian <John.Vivian@Exxecom.com> a écrit :

| 	A 'ping' consists of two types of ICMP packets; an "echo-request",
| 	and an "echo-reply".
| 	Take a look at the network traffic for "echo-requests" from the
| hosts
| 	that your machine is sending the "echo-reply" to; you should see
| them.

It should be better to look for echo-requests addressed to neural1.fe.up.pt
since source address of the echo-requests could be forged.

| 	i may be incorrect with this next statement (corrections anyone?),
| if
| 	you do not see any "echo-requests" that correspond to the
| "echo-replys"
| 	you are seeing, then it may be possible that someone has compromised
| 	your machines.  This is probably not the case, though i can't say
| for
| 	certain.  The bottom line is that if you see the "echo-requests",
| then
| 	mystery solved.  Otherwise, you may wish to post again with more
| details.
| 	Hope this helps.  Can anyone else provide more info?

I do not know any other reason for echo-replys...


mverdier@chez.com (Michel Verdier)

Reply to: