Can you provide a pcap with the suspect traffic isolated? Also, what alerted you to the odd behavior? Did the traffic flag an IDS alert?
bNull On Wed, Feb 25, 2009 at 9:27 AM, julio sanchez <[email protected]>wrote: > Hi, > > We're experiencing some weird arp traffic on our network, some box scan > constantly the subnets with loop "who-has" request > All the box are all windows vista sp1 fully patched. > We did format all the supect box, and isolate them on a vlan, to reinstall > vista, updates, kaspersky, then we put it back on the network, and still > some ramdom freshly formated box scanning the network. > We find out that Vista will do an arp scan when it search for a network > printer, but it does this once. > The problem we have is an almost permanent arp scan on various boxs. > We know that some worm was hitting some network around the world with the > smb vulnerability, but all of our boxs are fully updated. > Have you experienced something like this before, or it seems to be legit > traffic ? > Can this be a worm or something related ? > > Thanks in advance > > Pete > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
