Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

SQL-worm 1 IP multiple MAC???
From: "Ariesto" <skivebug2 () yahoo com sg>
Date: Wed, 3 Mar 2004 08:31:43 +0800

Hi all,

 

I've just found the old SQL-slammer again in my customer network and notice
something that I've never notice before:

 

The worm sends UDP packet using 1 static spoof source IP and 1 static spoof
dest IP, but the MAC address changes in every packet (mostly the source
mac).  What is happening here??  Have anybody notice this before?? 

 

Cheers,

 

-A


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault