[Snort-users] Increase in nmap pings

Frank Knobbe frank at ...9761...
Mon May 3 09:39:14 EDT 2004


On Mon, 2004-05-03 at 10:17, Chuck Holley wrote:
> I noticed some too. Not a whole lot but about a dozen.  Out of france?

We seeing tons of these as well. I'm not sure which malware is
responsible, but it looks like a worm and not like a decoy scan. The
info about Sasser doesn't mention ICMP pings, but it is still a
candidate. Perhaps a new Agobot variant that pings first?

Regards,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20040503/70ac6cf7/attachment.sig>


More information about the Snort-users mailing list