On Fri, 26 Oct 2001, Quibell, Marc wrote:
LOL!
I believe that the question should be: Why are you pinging me? Tell me what admin who sees thousands of ping from one host does not investigation the nature? Do mean to say that if you were to log thousands of pings, you would ignore them?
Also many ping attacks start with harmless ping probes.
The example you gave noted 2400 ICMP echo requests in a three hour period. On most systems I have worked with, the standard ping utility sends ICMP echo requests at a rate of one per second. This is 3600 echo requests per hour, 10800 in a three hour period. In my experience, is fairly common place to leave ping running for extended periods of time to observe network performance and detect intermittent problems. I would think this number of echo requests from a single host in such a timeframe is hardly abnormal, and I could care less. Should I receive 10800 echo requests in less than a minute I could become concerned, depending on the popularity of the system in question.
Marc
-----Original Message----- From: James Thomason [mailto:james@divide.org] Sent: Friday, October 26, 2001 3:00 PM To: Patrick W. Gilmore Cc: nanog@merit.edu; Quibell, Marc Subject: RE: [SOT Rant] Non-hostile probes / opt-in/out
If I did, and they responded negatively, I would tell them YOU said it was a good idea.
Seriously, why should the administrators of *.army.mil care if I test packet response time between our networks? Is this an illegal activity I am unaware of?
On Fri, 26 Oct 2001, Patrick W. Gilmore wrote:
At 02:16 PM 10/26/2001 -0500, Quibell, Marc wrote:
Maybe you should ping NS01.ARMY.MIL about 2400 times in 3 hour and see
if
you don't get a visit? Pinging a website 2 times means nothing..
How about 441 times in 2 hours? :)
Marc
-- TTFN, patrick