Re: icmp: echo reply? Am I being attacked?
John Vivian <John.Vivian@Exxecom.com> a écrit :
| A 'ping' consists of two types of ICMP packets; an "echo-request",
| and an "echo-reply".
|
| Take a look at the network traffic for "echo-requests" from the
| hosts
| that your machine is sending the "echo-reply" to; you should see
| them.
It should be better to look for echo-requests addressed to neural1.fe.up.pt
since source address of the echo-requests could be forged.
| i may be incorrect with this next statement (corrections anyone?),
| if
| you do not see any "echo-requests" that correspond to the
| "echo-replys"
| you are seeing, then it may be possible that someone has compromised
| your machines. This is probably not the case, though i can't say
| for
| certain. The bottom line is that if you see the "echo-requests",
| then
| mystery solved. Otherwise, you may wish to post again with more
| details.
|
| Hope this helps. Can anyone else provide more info?
I do not know any other reason for echo-replys...
--
o-o
mverdier@chez.com (Michel Verdier)
http://www.chez.com/mverdier
Reply to: