Security Basics mailing list archives

Ping Cyberkit 2.2


From: Dr Aldo Medina <aldomedina () hotpop com>
Date: 11 Sep 2003 21:12:36 -0500

Since about a week, my snort logs are full of messages like this:

Sep  6 12:27:56 linuxserver snort: [1:483:2] ICMP PING CyberKit 2.2
Windows [Classification: Misc activity] [Priority: 3]: {ICMP}
200.95.132.194 -> 200.95.123.16
Sep  6 12:29:23 linuxserver snort: [1:483:2] ICMP PING CyberKit 2.2
Windows [Classification: Misc activity] [Priority: 3]: {ICMP}
200.95.66.113 -> 200.95.123.16Sep  6 12:31:24 linuxserver snort:
[1:483:2] ICMP PING CyberKit 2.2 Windows [Classification: Misc activity]
[Priority: 3]: {ICMP} 200.95.132.65 -> 200.95.123.16Sep  6 12:39:01
linuxserver snort: [1:483:2] ICMP PING CyberKit 2.2 Windows
[Classification: Misc activity] [Priority: 3]: {ICMP} 200.95.21.229 ->
200.95.123.16Sep  6 12:41:52 linuxserver snort: [1:483:2] ICMP PING
CyberKit 2.2 Windows [Classification: Misc activity] [Priority: 3]:
{ICMP} 200.95.132.88 -> 200.95.123.16Sep  6 12:45:33 linuxserver snort:
[1:483:2] ICMP PING CyberKit 2.2 Windows [Classification: Misc activity]
[Priority: 3]: {ICMP} 200.95.132.131 -> 200.95.123.16
Sep  6 12:48:14 linuxserver snort: [1:483:2] ICMP PING CyberKit 2.2
Windows [Classification: Misc activity] [Priority: 3]: {ICMP}
200.95.129.36 -> 200.95.123.16Sep  6 12:51:10 linuxserver snort:
[1:483:2] ICMP PING CyberKit 2.2 Windows [Classification: Misc activity]
[Priority: 3]: {ICMP} 200.95.33.116 -> 200.95.123.16

Running Linux Debian Woody. Should I be worried?

TIA.



---------------------------------------------------------------------------
Captus Networks 
Are you prepared for the next Sobig & Blaster? 
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans 
 - Precisely Define and Implement Network Security 
 - Automatically Control P2P, IM and Spam Traffic 
FIND OUT NOW -  FREE Vulnerability Assessment Toolkit 
http://www.captusnetworks.com/ads/42.htm
----------------------------------------------------------------------------


Current thread: