If you have a large paste can you please put it in a pastebin. On Wed, Feb 25, 2009 at 7:50 PM, julio sanchez <pete.sanc...@gmail.com>wrote:
> No IDS alert yet. > What alerted us was the constant ARP loop scan on various vista sp1 box > while we was monitoring the network > I'll send a pcap in one hour or twoThanks > 2009/2/25 B Null <bn...@offenseindepth.com> > >> Can you provide a pcap with the suspect traffic isolated? Also, what >> alerted you to the odd behavior? Did the traffic flag an IDS alert? >> >> bNull >> >> On Wed, Feb 25, 2009 at 9:27 AM, julio sanchez <pete.sanc...@gmail.com>wrote: >> >>> Hi, >>> >>> We're experiencing some weird arp traffic on our network, some box scan >>> constantly the subnets with loop "who-has" request >>> All the box are all windows vista sp1 fully patched. >>> We did format all the supect box, and isolate them on a vlan, to >>> reinstall vista, updates, kaspersky, then we put it back on the network, and >>> still some ramdom freshly formated box scanning the network. >>> We find out that Vista will do an arp scan when it search for a network >>> printer, but it does this once. >>> The problem we have is an almost permanent arp scan on various boxs. >>> We know that some worm was hitting some network around the world with the >>> smb vulnerability, but all of our boxs are fully updated. >>> Have you experienced something like this before, or it seems to be legit >>> traffic ? >>> Can this be a worm or something related ? >>> >>> Thanks in advance >>> >>> Pete >>> >>> _______________________________________________ >>> Full-Disclosure - We believe in it. >>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>> Hosted and sponsored by Secunia - http://secunia.com/ >>> >> >> > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > -- http://www.goldwatches.com/ http://www.jewelerslounge.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
