18 Dec
2003
18 Dec
'03
3:19 a.m.
Deepak Jain wrote:
Infected machines send up to 300pps per machine of ICMP packets which fall into the 96 slot above. So in this example you probably have many of them.
Couldn't this also mean he is being probed/attacked by many as well?
Certainly but this high ratios are usually only attainable if you´re close to the source of the traffic. Try to match the 96 packet size fraction to the ICMP fraction you have. Obviously the next thing to check is where the traffic is coming (if you´re interested enough to get rid of it) Pete