12 Sep
2017
12 Sep
'17
2:59 p.m.
On Tue, Sep 12, 2017 at 11:36 AM, lleachii--- via 44Net 44net@hamradio.ucsd.edu wrote:
All,
I've noticed some pings from portal.ampr.org:
2017-09-11 17:32:25.846 48.191 ICMP 81.174.235.134:0 -> 44.60.44.10:8.0 38 3192 1
Is this an automated software pinging?
- Lynwood
KB3VWG
It's an AMPRNet ICMP amplification attack. The way it works is every time there is ICMP traffic on AMPRNet, someone reports it to this mailing list. Then there are usually a few replies. This has the effect of turning 64 bytes of ICMP into a storm of SMTP TCP traffic.
Tom KD7LXL