thr3ads.net - freebsd security - scheduled pings [May 2004]

If this information is useful, please help other people find it:
Share via:

Matt Gostick

2004-May-06 17:39 UTC

scheduled pings

Hello,
 
I have just setup some ipfw rules to checkout some traffic to one of my
boxes.  I have three servers, only one of which has weird traffic.  It
is getting ping'd on a five minute interval from approx 3 to 8 different
ip addresses within the same second.  For example:
 
May  3 20:20:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 202.160.241.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:20:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 202.160.241.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 64.35.7.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 212.162.1.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 216.74.133.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 63.218.7.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:03 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 166.90.213.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:04 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 205.158.108.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 64.35.7.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 212.162.1.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 216.74.133.194
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 63.218.7.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:13 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 166.90.213.130
xxx.xxx.xxx.xxx in via dc0
May  3 20:25:14 gaspra kernel: ipfw: 65002 Deny ICMP:8.0 205.158.108.194
xxx.xxx.xxx.xxx in via dc0
 
I've just started denying pings to the box...
 
What is this?
 
Matt Gostick <matt@crazylogic.net>

Chuck Swiger

2004-May-07 09:09 UTC

head link

scheduled pings

Matt Gostick wrote:> I have just setup some ipfw rules to checkout some traffic to one of my
> boxes.  I have three servers, only one of which has weird traffic.  It
> is getting ping'd on a five minute interval from approx 3 to 8
different
> ip addresses within the same second.  For example:
[ ... ]> I've just started denying pings to the box...
There are a bunch of network monitoring tools which will do something like 
this, normally used by ISPs and the like to verify that a server is up; you 
should contact whoever owns the source IPs and ask them what they're doing.

-- 
-Chuck

Maybe Matching Threads

Search for more apparently analagous threads

freebsd security - May 2004 - scheduled pings

scheduled pings

scheduled pings

Maybe Matching Threads