Re: RE: Strange echo requests from 127.0.0.1 apparentlyto root nameservers

Terry, 

ICMP is not like other protocols.  Whereas both TCP and UDP have a
concept of sockets and listening ports (which is what all those utils
key in on), ICMP doesn't.  It's just "control" messages, and are
therefore handled by the operating system and not an application. 
Fport and Handle are great for when you discover a listening port on
your system and want to know which app is using it.  They are even of
some help when you try to find out which app on your system is sending
out TCP or UDP traffic.  But in my experience i haven't found anything
that tells you which app is sending out ICMP packets.

Your best bet, IMHO, is to look at the payload/padding of the ICMP
packet and try to fingerprint the app that way.  Many different
network monitoring apps craft their own ICMP packets and can be
identified by the padding.

Good luck

On Mon, 30 Aug 2004 09:47:29 +0200, Terje Trane <[email protected]> wrote:
> > Roland wrote:
> > There is a shareware utility developed by Foundstone, Inc.
> > http://www.foundstone.com called fport.exe which is able link
> > the port
> > and pid in one command line program.
> 
> Thanks, but I already have this. It shows open ans listening TCP and UDP
> ports, but not ICMP.
> 
> > In addition there is another utility called handle developed by
> > Sysinternals @
> > http://www.sysinternals.com/ntw2k/freeware/handle.shtml.
> > This utility links process IDs to ports and program names,
> 
> Thanks, I downloaded this and immediatly made it a part of my toolbox. I'm
> not shure how this will help. I'am not near the machine we are researching
> now, but I tested on my laptop. I started a ping and ran handle. Searching
> for ping.exe in the result I find:
> 
> ping.exe pid: 2304 SYSTEK-NETBIOS\trane
>    c: File          C:\Documents and Settings\trane
>  778: File
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
> .2600.2180_x-ww_a84f1ff9
> 
> Nothing here tells me that this process was sending ICMP packets anywhere.
> 
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
>
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions