Security Incidents mailing list archives

strange icmp echo request

From: Tillmann Werner <tillmann.werner () gmx de>
Date: Sun, 28 Aug 2005 13:35:15 +0200

Hi all,

i stumbled on the attached ping request yesterday. Interesting seq number, 
funny payload. Has anyone ever seen something similar? Any ideas about the 
generator?

15:25:58.975010 IP (tos 0x0, ttl  53, id 0, offset 0, flags [DF], length: 78) 
65.254.52.106 > 145.254.138.138: icmp 58: echo request seq 8009
        0x0000:  4500 004e 0000 4000 3501 b2be 41fe 346a  E..N..@.5...A.4j
        0x0010:  91fe 8a8a 0800 4bb2 0001 1f49 f9ed 0100  ......K....I....
        0x0020:  0000 0bb8 0003 ff3e de1e 198b 0f66 7470  .......>.....ftp
        0x0030:  2d73 7368 2d74 6172 6765 7473 0000 0000  -ssh-targets....
        0x0040:  0000 0000 0000 0000 0000 0000 0000       ..............

Thanks for hints.
Tillmann

Attachment: _bin
Description:

Current thread:

strange icmp echo request Tillmann Werner (Aug 29)