RE: synchronized pings
> El 10 de oct de 2002, a las 09:31 +0000, P. Ook escribio:
> > Hi all,
> >
> > I've found 'synchronized pings' in my logs from several
> hosts all around the world.
> > Today they where 11 hosts more or less doing ping to my
> Debian box at the same time
> > (11 pings in the same second). Sure this is not a DOS
> attack, almost for my server,
> > but i can't understand why they are pinging me all at the
> same time, three o more
> > times a day. Any ideas?
> >
> > Searching in the logs I found pings from same of theese
> hosts a month ago, but in that
> > days they were only 3-5 hosts pinging me at the same time...
> >
> > Thank you very much in advance.
> ------ Fin de mensaje original ------
>
> Hi!!
>
> These could be what people said "smurf attack". Take a look at:
If it was a smurf attack, you'd see pings from hosts on the same subnet
(since the idea is one echo results in more than one reply). Since
they're all different in his logs, this basically rules smurf out.
If you check the IPs, they all belong to one company (SPEEDERA) who
specialise in content delivery. I'm guessing someone in your network
(or even yourself) is viewing some sort of media they distribute, and
one of the techniques for finding the closest distribution point to you
could be a simple ping test.
Akamai do it if I recall, and these people seem very similar. They
usually welcome requests to stop testing, since some people do get
annoyed.
HTH,
Andy.
Reply to: