• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

ICMP (Ping) attacks on my firewall

F

fmalgapo

n00b
Joined
Apr 6, 2004
Messages
12
At work, my network seems to slow down a great deal every so often. I ran Symantec and AVG on every machine as well as Adaware and made sure every box on the network is virus-free. The netscreen people walked me through setting up some policies showing viruses and logging their IPs in a log file. I also set up a policy for PING and ICMP traffic also with logs.
So far, none of these policies affected the problems I've been having trying to track down the boxes with viruses slowing down the network. One tech from Netscreen suggested it was a "Nachia" virus which is aka "Ping-of-Death". I ran some cleanup tools for that as well and could find nothing.

The equipment is a Netscreen 5 firewall, majority of the boxes in the network are win2k, few winxp pro, and 1 98se box.

Help :confused:
 
You really need to get your hands on a network sniffer so you can see what type of traffic is flooding your network...
 
Agreed. You need to put a sniffer on your network that will detect the packets. If you dont have a switch with a SPAN port on it, plug all the PC's into a hub and plug the PC with the sniffer into the hub as well. Use something like Ethereal (which is free). That should give you source IP's (unless they're being spoofed) and source MAC addresses (unless those are being spoofed as well). You can also just elimate machines by unplugging them one at a time, if you start seeing ICMP traffic from a particular host go away, then you know to check that box. Do this after hours, and do yourself a favor by not plugging the hosts back into the network once you've figured out whether or not they're infected with something. Once all the infected systems are cleaned, you should scan everything again to be sure, then start plugging PC's back in.

Nachi pings are not the same as the 'Ping of Death.' That term is used to describe a ping which exceeds 65,536 bytes - which is an illegal size. It crashes some older systems that can't handle it. I think the last Windows platforms to be vulnerable to it were 95 and NT, and there were patches out for both of those versions too I think. Nachi pings are different than normal pings. Normal pings are 32 bytes in length in Windows and (I think) 64 bytes in *nix, Nachi pings are 92 bytes in length and contain the data "aaaaaaaaaaaaaaaaaaa" in the packet. I think all Nachi variants do this. So if you're using Ethereal (or any sniffer) and you're looking at the ICMP Echo Request packets, you'll be able to see if its Nachi by looking for the repeating "a" characters as the data of the packet.
 
OK, i tried to simulate the conditions at work while no one is in the office, I even have a saved capture file of 42min of network activity..What am I looking for?

I noticed there are many instances of IPv6 (0x3a) with a source address of fe80:202:55ff:fe56:cdde

If anyone is willing to look, i can send the capture file directly to you.
 
I'll take a look. I private messaged my email address to you.
 
You must log in or register to reply here.
Back
Top