SQL-worm 1 IP multiple MAC???

["Ariesto" <skivebug2 () yahoo com sg>]

Hi all,

 

I've just found the old SQL-slammer again in my customer network and notice
something that I've never notice before:

 

The worm sends UDP packet using 1 static spoof source IP and 1 static spoof
dest IP, but the MAC address changes in every packet (mostly the source
mac).  What is happening here??  Have anybody notice this before?? 

 

Cheers,

 

-A