strange icmp echo request
Tillmann Werner <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <[email protected]> |
Hi all,
i stumbled on the attached ping request yesterday. Interesting seq number,
funny payload. Has anyone ever seen something similar? Any ideas about the
generator?
15:25:58.975010 IP (tos 0x0, ttl 53, id 0, offset 0, flags [DF], length: 78)
65.254.52.106 > 145.254.138.138: icmp 58: echo request seq 8009
0x0000: 4500 004e 0000 4000 3501 b2be 41fe 346a [email protected]
0x0010: 91fe 8a8a 0800 4bb2 0001 1f49 f9ed 0100 ......K....I....
0x0020: 0000 0bb8 0003 ff3e de1e 198b 0f66 7470 .......>.....ftp
0x0030: 2d73 7368 2d74 6172 6765 7473 0000 0000 -ssh-targets....
0x0040: 0000 0000 0000 0000 0000 0000 0000 ..............
Thanks for hints.
Tillmann
signature.asc
(application/pgp-signature, 481 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iQEVAwUAQxGhe3195S4iyWW4AQJcPAf/UOx39udPTij5IMULgumfbigj81xS/q5Z Hmuf5KEc71PijGPqB35fQrgz+zhgDGs2cUWiUmIgTvfF42Hb/dX0lIgLV8PZ274r NWs9KCt2R1rNEFGKcoKfCm0bnbji6rcX26YVXtRgZyYpBIweL18QS3KX6TODN41m jBxREAblw+G/9e6fjsyqr8f3wv5iT9qQM9lwKjEatWPrxoyNngLK8aAswXwHDILn vA+v2utOHK746Wz7Y0VhG0aKDNuXk5OWXtI3CFE+2JRUg3IKbWhZIUBv/CI2j/3k BC7RvahuljVVxhaI4NPhb2NrNqjo/B8jCqv+HrRmhDh1rRp5o6SYxg== =EgoX -----END PGP SIGNATURE-----