Increase ping activity

[jassrs]

Has anyone noticed an increase of ping activity to their networks? And if so, where is it coming from?

 

[Sapient2003]

Ping packets are common to everyone, being a large network or an individual user. They are sent by anyone, your ISP, or anyone wanting to know how long it takes for packets to be sent to you. There is no need to worry, as it is typical Internet activity.

--Sapient2003 - sapient@sapient2003.com
"The worst insecurity is believing you are too secure."

 

[MattWray]

You may be mistaken Sapient, check out this thread by BCastner, thread581-646518

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

 

[Sapient2003]

Nope, not mistaken. Why would anyone preform any DoS attack on randon hosts? Doesn't make sense doing it that way.

--Sapient2003 - sapient@sapient2003.com
"The worst insecurity is believing you are too secure."

 

[funkygibbon]

I suspect the increased traffic is down to the Nachi worm (or variants) - certainly we've seen a marked increase in ICMP traffic over the last month or so.

 

[jassrs]

Thanks mattray for the thread link....
My ICMP traffic is incredible borderline ridiculus.

 

[confusedtekguy]

jassrs, we caught the nachi worm a few weeks ago on our network. DOS attack crashed our firewall and stoped network traffic.

As a quick-fix we blocked all outgoing TCP ports 666-765, which gave us access to the internet and killed the DOS attack.

Then we had to figure out which computers were infected and which weren't. Easiest way to pinpoint those was to monitor the network activity and see which computers would try to communicate with others on the domain the most. Since nachi sends itself out on TCP port 135 or 80 you can quickly find out which machine is infected and use symantec/mcafee hotfixes to repair it. Hope this helps

 

[jassrs]

My pings are coming into port 8 from 12.xxx.xxx.xxx range (ICMP packets are being dropped). I dont think we have the nachi since we are still able to function. How can I get some of this activity slowed down or do I just ride it out?