Re: Pings - next-www-clients
"James C Slora Jr" <[email protected]> Fri, 10 Jun 2005 13:40:45 -0400
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Organization | PHR+A, pc |
| Message-ID | <[email protected]> |
ICMP pings from multiple hosts within a subnet. I'm guessing this is something to do with WebTrends or StatsMachine type tracking. Summary: [sourceIP] - [string] 207.212.223.x - "ping-all" 216.58.224.x - "top-www-clients" or "next-www-clients" 129.(33 or 41).x.x and 170.224.33.x - "top-10000" 167.142.57.x - "web-clients" Some example packets, taken from the ICMP Type field onward: 2005-05-03 207.218.223.101 08 00 84 b5 00 01 74 23 e0 ab 01 00 00 00 0b b8 00 03 f6 32 d5 8f 9f 83 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-03 207.218.223.92 08 00 06 d2 00 01 46 f3 d0 8f 01 00 00 00 0b b8 00 03 f6 33 0d 3e 23 04 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-03 207.218.223.90 08 00 01 4b 00 01 c9 ff e9 a3 01 00 00 00 0b b8 00 03 f6 33 44 ba 54 ee 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-03 207.218.223.95 08 00 9b 7d 00 01 d0 57 28 27 01 00 00 00 0b b8 00 03 f6 33 7c 00 3e 9a 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-03 207.218.223.90 08 00 ed c0 00 01 d0 6f f9 af 01 00 00 00 0b b8 00 03 f6 36 70 74 26 3f 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-03 207.218.223.99 08 00 c9 4b 00 01 1b 53 98 2b 01 00 00 00 0b b8 00 03 f6 38 26 df aa e8 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-04 207.218.223.94 08 00 94 f7 00 01 dc df 0a af 01 00 00 00 0b b8 00 03 f6 4a a4 2a 2d cf 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-04 207.218.223.97 08 00 5f 3a 00 01 65 43 66 d7 01 00 00 00 0b b8 00 03 f6 4b 0f 75 13 b5 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-04 207.218.223.93 08 00 c1 df 00 01 ea 4f 43 bf 01 00 00 00 0b b8 00 03 f6 4c f1 06 6d 88 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2005-05-04 207.218.223.89 08 00 ac a1 00 01 fc eb e9 43 01 00 00 00 0b b8 00 03 f6 4d 2f b1 8b fa 08 70 69 6e 67 2d 61 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions