Home page logo

fulldisclosure logo Full Disclosure mailing list archives

SQL-worm 1 IP multiple MAC???
From: "Ariesto" <skivebug2 () yahoo com sg>
Date: Wed, 3 Mar 2004 08:31:43 +0800

Hi all,


I've just found the old SQL-slammer again in my customer network and notice
something that I've never notice before:


The worm sends UDP packet using 1 static spoof source IP and 1 static spoof
dest IP, but the MAC address changes in every packet (mostly the source
mac).  What is happening here??  Have anybody notice this before?? 





  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]