Re: ICMP Type:8 Code:137

On Fri, 28 Oct 2005 21:18:27 +0200, "Allan Kjeldbjerg (Acom Internet ApS)" said:
> Hi _mutiger_jh,
> 
> Yes I have notice the increase of the same packets. They could be spoofed 
> but the one I currently
> notice originate from China and is distributed via ISP's in New York.
> 
> Concurrently with these packets we expirence non terminating TCP connections 
> on our Windows platform.
>  - Could there be a connection between the two? Anyone noticed the same 
> pattern?

Out of curiosity, are these fragged packets?  I'm wondering if the first frag
is getting lost and something's misinterpreting a 2nd or following frag - remember
that the *real* TCP/UPD/ICMP header is only in the first frag.  So if your
monitoring tool looks at a subsequent frag, it could be minsinterpreting the
payload as header (similar to the tool that misinterpreted an ICMP as UDP and got
a port number instead of a ICMP type/code).

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFDYrrKcC3lWbTT17ARAnsMAJsG9M9LLwhfFYSCg3hc1lyBfHOhDwCeJHpQ
SeWYYB9OC89/mnMbPqn7McY=
=VEpk
-----END PGP SIGNATURE-----