Re: Re[1]: synchronized pings
Can you add a Date-Header please ??? I am filtering my around 1700 Mails
(Lists) each day and only yours give me permanetly Errors !!!
Michelle Konzack
Systemadministrator
Am hat P.Ook geschrieben:
>
>The logs are from a firewall box serving a small student net. I'll
investigate if
>people in this net are using services from 'speedera', as all the ips
seems to belong
>to that company.
>
>Thank you very much for your help.
>Bye.
>
> MA.Varó
>
>> -------Mensaje original-------
>> De: "Andy Coates" <andy@bribed.net>
>> Fecha: 10/10/102 23:55:22
>>
>> > El 10 de oct de 2002, a las 09:31 +0000, P. Ook escribio:
>> > > Hi all,
>> > >
>> > > I've found 'synchronized pings' in my logs from several
>> > hosts all around the world.
>> > > Today they where 11 hosts more or less doing ping to my
>> > Debian box at the same time
>> > > (11 pings in the same second). Sure this is not a DOS
>> > attack, almost for my server,
>> > > but i can't understand why they are pinging me all at the
>> > same time, three o more
>> > > times a day. Any ideas?
>> > >
>> > > Searching in the logs I found pings from same of theese
>> > hosts a month ago, but in that
>> > > days they were only 3-5 hosts pinging me at the same time...
>> > >
>> > > Thank you very much in advance.
>> > ------ Fin de mensaje original ------
>> >
>> > Hi!!
>> >
>> > These could be what people said "smurf attack". Take a look at:
>>
>> If it was a smurf attack, you'd see pings from hosts on the same subnet
>> (since the idea is one echo results in more than one reply). Since
>> they're all different in his logs, this basically rules smurf out.
>>
>> If you check the IPs, they all belong to one company (SPEEDERA) who
>> specialise in content delivery. I'm guessing someone in your network
>> (or even yourself) is viewing some sort of media they distribute, and
>> one of the techniques for finding the closest distribution point to you
>> could be a simple ping test.
>>
>> Akamai do it if I recall, and these people seem very similar. They
>> usually welcome requests to stop testing, since some people do get
>> annoyed.
>>
>> HTH,
>> Andy.
>>
>>
>>
>______________________________________________________
>Consigue tu e-mail gratuito en Lycos. Entra en http://www.lycos.es
>Consigue tu propio Hosting y Dominio al mejor precio:
http://webcenter.lycos.es/
>Elvis vs JXL ya a la venta http://www.lycos.es/webguides/especial/elvis/
>
>
> ########## Get the Power of Debian/GNU-Linux ##########
Reply to: