Has anyone figured out if CW2K, nGenius/IPM or DFM has the capability to detect the Nachi worm (92 byte ICMP type 80) signature/symptoms (ICMP echo storm, etc.) and alert upon detection? This would include any way to detect/alert upon a large deviation from a baseline count of ICMP deny ACL statements. Any help in configuring any of these tools would be appreciated. Thank you. -dg
Denny G
Denny G