Most likely someone is trying to use a smurf attack program using your
broadcast addresses. Research smurf.c at rootshell.com
-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-
Larry Pingree
Sr. Security Consultant
Email: [EMAIL PROTECTED]
SiegeWorks
WebSite: http://www.siegeworks.com/
Enterprise Support, Security Consulting and Training
-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-
----- Original Message -----
From: Reed Mohn, Anders <[EMAIL PROTECTED]>
To: Fw-1-Mailinglist (E-mail) <[EMAIL PROTECTED]>
Sent: Tuesday, April 17, 2001 5:33 AM
Subject: [FW1] Selected pings?
>
>
> Quite a few times lately, I've been seeing pings
> coming in to a small selection of addresses on our (class C) network.
> (host addresses 0, 8, 63, 64, 127, 128, 191, 192, and 254)
> The pings come from different places every time.
> Now, breaking a class C network in 4, would make these addresses the
> zero and broadcast addresses of each subnet, except for 8 and 254.
> So, can anyone tell me what the point is in scanning something like this?
>
> The pings don't make it through the FW, but if they did, what information
> could someone gain from this?
> I tried this myself, and the PC's on our network seem to ignore the pings
> anyway.
>
>
> Cheers,
> Anders RM :)
>
>
>
============================================================================
====
> To unsubscribe from this mailing list, please see the instructions at
> http://www.checkpoint.com/services/mailing.html
>
============================================================================
====
>
>
smime.p7s
