Re: ICMP Type:8 Code:137
Justin <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <[email protected]> |
Mutiger_jh, It could indeed be a recon technique (the traceroute makes me think that even more). Custom ICMP programs are not that difficult to make, so maybe somebody is using your system(s) as a testing ground? This also reminds me of xprobe2. Doesn't that send ICMP like what you described? Are these targetd in sweeps across your netrange, or is it just against one specific host. Hope some of that helped... peace, --Justin On 28 Oct 2005 03:12:09 -0000, [email protected] <[email protected]> wrote: > We have been seeing a good number of ICMP - echo requests coming in bursts having a code of 137 in the last couple of days. The burst do not last long but are sometimes preceeded by a traceroute. No other traffice follows from the source hosts. There is no payload in the packets. My research into what or why this is happening has turned up nothing. > > Has any one heard of any attacks or recon using this code? >