icmp flooding, distributed ddos?

[jullrich at euclidian.com (Johannes Ullrich)]

On Thu, 2003-09-04 at 14:41, Jeff Kinz wrote:
> Anyone seeing signs of a distributed icmp dos?

maybe your are seeing Nachia/Welchia traffic?


hope this is not too 'commercial' for the list. But I will
be giving a (free) talk about this on the 17th ;-)
as part of the Boston SANS conference:
http://www.sans.org/newengland03/special.php


-- 
--------------------------------------------------------------
Johannes Ullrich                     jullrich at euclidian.com
pgp key: http://johannes.homepc.org/PGPKEYS
--------------------------------------------------------------
   "We regret to inform you that we do not enable any of the 
    security functions within the routers that we install."
         support at covad.net
--------------------------------------------------------------