Security Incidents mailing list archives

strange icmp traffic


From: globi () GRAFF COM PL (Dariusz Zmokly)
Date: Mon, 10 Jan 2000 14:12:08 +0100


hi !

I have just started IMON V 0.9b and see strange things. My network is
212.160.143.0 - 212.160.143.31. How is it possible to see ICMP packets
having both origin and destination set to addresses out of my network ?
Does it mean that some host here has been owned ?

203.227.180.210 -> 3.150.160.18 (IPv2) was 'echo reply'
203.228.180.210 -> 5.140.128.16 (IPv2) was 'echo reply'
203.228.180.210 -> 5.140.128.24 (IPv2) was 'echo reply'
209.140.180.210 -> 5.140.128.24 (IPv2) was 'echo reply'
214.58.180.210 -> 5.140.128.17 (IPv2) was 'echo reply'
214.59.180.210 -> 5.141.128.16 (IPv2) was 'echo reply'

Another strange thing:

127.0.0.1 -> 127.0.0.1 (IPv4) was 'port unreachable'
127.0.0.1 -> 127.0.0.1 (IPv4) was 'port unreachable'

And:

badly formed ICMP packet (type=96, code=50)
119.138.218.126 -> 20.173.176.18 (IPv13) was ''
badly formed ICMP packet (type=97, code=27)
119.139.218.126 -> 22.178.128.16 (IPv13) was ''
badly formed ICMP packet (type=97, code=27)
119.139.218.126 -> 22.178.128.24 (IPv13) was ''
badly formed ICMP packet (type=97, code=27)
120.113.218.126 -> 22.178.128.17 (IPv13) was ''
badly formed ICMP packet (type=98, code=71)
120.114.218.126 -> 22.178.128.16 (IPv13) was ''
badly formed ICMP packet (type=98, code=108)
119.139.218.126 -> 22.178.128.25 (IPv13) was ''
badly formed ICMP packet (type=98, code=113)
120.114.218.126 -> 22.179.128.16 (IPv13) was ''

badly formed ICMP packet (type=96, code=249)
199.162.0.8 -> 166.102.96.18 (IPv0) was ''
badly formed ICMP packet (type=96, code=249)
199.163.0.8 -> 166.114.80.16 (IPv0) was ''
badly formed ICMP packet (type=96, code=249)
199.163.0.8 -> 166.166.80.16 (IPv0) was ''
badly formed ICMP packet (type=96, code=249)
199.163.0.8 -> 166.166.80.24 (IPv0) was ''
badly formed ICMP packet (type=96, code=249)
199.163.0.8 -> 166.166.80.24 (IPv0) was ''

regards,
Dariusz Zmokly


Current thread: