[Snort-users] Increase in nmap pings

Michael Schwartzkopff misch at ...3397...
Mon May 3 05:50:05 EDT 2004


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

since 9:00 CEST (7:00 GMT) I see a massive increase in nmap pings SID 469.

Characteristics:
- - Seems to stay in the class B net. So origin always in the class B net, where 
we are located. Only few exeptions.

- - Ping to the src address works.

- - scan of the src address shows a windows PC.

Some questions:
- - Is this related to the sasser worm?
- - Anybody else seeing it?

- -- 
Dr. Michael Schwartzkopff
MultiNET Services GmbH
Bretonischer Ring 7
85630 Grasbrunn

Tel: (+49 89) 456 911 - 0
Fax: (+49 89) 456 911 - 21
mob: (+49 174) 343 28 75

PGP-ID: 15F925D9CEF94F2C
Fingerprint: AF27 2674 4631 E230 B431  F68D 15F9 25D9 CEF9 4F2C

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)

iD8DBQFAlj93Ffkl2c75TywRAkuJAJ9LO3YC1f72/7pOpvWaJjF7BzokFACfSeFi
RMieeAG0wFsCGKHeayNLXiE=
=MdGS
-----END PGP SIGNATURE-----





More information about the Snort-users mailing list