I was forced to kill all ICMP Echo (they can still use traceroute) requests from my dial-up users to solve network issues related to the ICMP probing done by the Welchia worm. Even theough the ping packets don't fill the bandwidth, they somehow cause all the interfaces to bog down with slow responses even at around 50% utilization. I was bombarded with authentication issues since my radius servers were being hammered.
Welchia, BTW, is a blaster killer (it will unload blaster and download and install the MS patch, then reboot), but its replication engine uses ICMP to build a list of machines for infection attempts, and seems to keep retrying. Most other vireuses just attempt infection then move to the next IP. Thanks, Chuck Frolick ArgoNet, Inc. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, August 29, 2003 12:14 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] OT NEWS FLASH: Adelphia views Pings as illegal >Of all the lame brain $$%&$#$#&^*([EMAIL PROTECTED] ideas! > >They silently sent out commands to reprogram all modems to block all ICMP >traffic. Inbound and Outbound. The only information I can find about that is http://www.dslreports.com/comment/1576/37808 , which shows that it was related to Sobig. I know that Charter Communications was also blocking ICMP packets (and even DNS packets for a shorter period of time) shortly before Sobig.F's "Second Attack" was going to occur last Friday. These seem to have been purely temporary precautionary measures. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
