Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: anyone who saw this arp traffic? |
|---|---|
| Date: | Sun, 27 Feb 2005 06:27:03 +0530 |
Have seen similar ARP broadcasts when windows machines on our network got hit by worms. Which worms i dont quite remember. Perhaps blaster. regards Ankush Kapoor On Wed, 23 Feb 2005 01:40:43 +0000, Monty Ree <chulmin2@hotmail.com> wrote:
Hello, all. When I capture network traffic at server farm,I can see lots of arp broadcast like below. But there is no server which use 172.16.x.x ip address. and curiously, 1. source ip and destination ip is same 2. more curiously, same traffic(source mac:0:10:dc:f1:f7:64 , source ip:172.16.97.157) is seen at my office. 3. I can also see this traffic(source mac:0:10:dc:f1:f7:64 , source ip:172.16.97.157 ) at other IDC. Have you ever seen this traffic? Thanks in advance. 10:15:26.759069 0:10:dc:f1:f7:64 Broadcast arp 60: arp who-has 172.16.97.157 (Broadcast) tell 172.16.97.157 10:15:26.803792 0:c:76:4e:4:c8 Broadcast arp 60: arp who-has 172.16.100.103 (Broadcast) tell 172.16.100.103 10:15:26.955878 0:c:76:4e:4:c8 Broadcast arp 60: arp who-has 172.16.100.103 (Broadcast) tell 172.16.100.103 10:15:26.967737 0:10:dc:f1:f7:64 Broadcast arp 60: arp who-has 172.16.97.157 (Broadcast) tell 172.16.97.157 _________________________________________________________________ ê.. ê.. ë.. ì.. ë.. ë.. ë.. ê.. MSN ëë http://www.msn.co.kr/love/
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Disaster Recovery Tool, Vijay Vikram |
|---|---|
| Next by Date: | Re: Simple Scan, Ankush Kapoor |
| Previous by Thread: | RE: anyone who saw this arp traffic?, dissolved |
| Next by Thread: | RE: anyone who saw this arp traffic?, Andrew Shore |
| Indexes: | [Date] [Thread] [Top] [All Lists] |