[893] in resnet
Re: huge spike in ICMP traffic
daemon@ATHENA.MIT.EDU (David Roback)
Wed Feb 27 15:28:00 2002
MIME-version: 1.0
Content-type: text/plain; format=flowed; charset=us-ascii
Content-transfer-encoding: 7BIT
Message-ID: <3C7D3D14.7060107@hamilton.edu>
Date: Wed, 27 Feb 2002 15:09:56 -0500
Reply-To: droback@hamilton.edu
From: David Roback <droback@hamilton.edu>
To: RESNET-L@listserv.nd.edu
We have also seen the same problem with one user on campus. Huge
amounts of ICMP traffic over a single connection (not multiple
connections to multiple sites - only one connection client to server 2-3MB).
We have scaled back the throughput on his port and are on our way to
check his computer.
--
David Roback - Network Systems Administrator
Hamilton College
198 College Hill Road Clinton, NY 13323
315-859-4987 - droback@hamilton.edu
Edward Chase wrote:
> Last night / early this morning our network experienced a huge spike in
> ICMP traffic.
>
> As far as I know our firewall should be stopping this type of traffic
> from
> flowing in and out of our campus. It definitely seems to be stopping the
> inbound traffic, yet appears to be allowing some of the outbound. I'm
> not
> sure why yet, I've got a message off to our support people.
>
> My question... Does anyone know of any new application or virus that
> works
> using ICMP traffic?
>
> (Here's where my lack of understanding the traffic the wire shows...)
>
>
>
> ---------------------------------------------------------------
> Edward F. Chase III | echase@providence.edu
> Providence College | http://www.providence.edu
> Computer Services | http://studentweb.providence.edu
> Providence, RI 02918 |
>
> ___________________________________________________
> You are subscribed to the ResNet-L mailing list.
>
> To subscribe, unsubscribe or search the archives,
> go to http://LISTSERV.ND.EDU/archives/resnet-l.html
> ___________________________________________________
>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
