12 Sep
2017
12 Sep
'17
2:36 p.m.
All,
I've noticed some pings from portal.ampr.org:
2017-09-11 17:32:25.846 48.191 ICMP
81.174.235.134:0 ->
44.60.44.10:8.0 38 3192 1
Is this an automated software pinging?
- Lynwood
KB3VWG
12 Sep
12 Sep
2:59 p.m.
On Tue, Sep 12, 2017 at 11:36 AM, lleachii--- via 44Net
<44net(a)hamradio.ucsd.edu> wrote:
All,
I've noticed some pings from portal.ampr.org:
It's an AMPRNet ICMP amplification attack. The way it works is every
time there is ICMP traffic on AMPRNet, someone reports it to this
mailing list. Then there are usually a few replies. This has the
effect of turning 64 bytes of ICMP into a storm of SMTP TCP traffic.
Tom KD7LXL
2017-09-11 17:32:25.846 48.191 ICMP
81.174.235.134:0 ->
44.60.44.10:8.0 38 3192 1
Is this an automated software pinging?
- Lynwood
KB3VWG 
3:14 p.m.
It's an AMPRNet ICMP amplification attack. The way
it works is every
time there is ICMP traffic on AMPRNet, someone reports it to this
mailing list. Then there are usually a few replies. This has the
effect of turning 64 bytes of ICMP into a storm of SMTP TCP traffic.
I don't care who you are, that's funny.
--
Rial F Sloan II
N0OTZ
AMPRNet Volunteer Coordinator - State of Georgia
3:45 p.m.
Tom;
On Tue, 2017-09-12 at 11:59 -0700, Tom Hayward wrote:
It's an AMPRNet ICMP amplification attack. The way
it works is every
time there is ICMP traffic on AMPRNet, someone reports it to this
mailing list. Then there are usually a few replies. This has the
effect of turning 64 bytes of ICMP into a storm of SMTP TCP traffic.
Is this like a nagios alarm? ;->
--
I used to be a heavy gambler. But now I just make mental bets.
That's how I lost my mind.
--------
73 de Brian - N1URO/AFT1BR,
President - EastNet Packet Network
https://www.eastnetpacket.org
email: (see above)
Web: http://www.n1uro.net/
Ampr1: http://n1uro.ampr.org/ (ipv4 AND ipv6)
Ampr2: http://nos.n1uro.ampr.org
Linux Amateur Radio Services
axMail-Fax & URONode
http://uronode.sourceforge.net
http://axmail.sourceforge.net
AmprNet coordinator for:
Connecticut, Delaware, Maine,
Maryland, Massachusetts,
New Hampshire, New Jersey, Pennsylvania,
Rhode Island, and Vermont.
3:13 p.m.
OK...
I'm guessing Tom's reply was in jest...???
If the server can be checked *if the behavior is unknown,* that would be
appreciated.
Servers shouldn't start exhibiting new behaviors by themselves (i.e.
pinging people without interaction from the operator).
73,
- KB3VWG
The way it works is every time there is ICMP traffic
on AMPRNet, someone reports it to this mailing list.
3:44 p.m.
Don't panic, it was only me doing some tests!
Chris
Sent from my iPhone
On 12 Sep 2017, at 19:36, lleachii--- via 44Net
<44net(a)hamradio.ucsd.edu> wrote:
All,
I've noticed some pings from portal.ampr.org:
2017-09-11 17:32:25.846 48.191 ICMP
81.174.235.134:0 -> 44.60.44.10:8.0 38 3192 1
Is this an automated software pinging?
- Lynwood
KB3VWG
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net
3:57 p.m.
Chris;
On Tue, 2017-09-12 at 20:44 +0100, Chris via 44Net wrote:
Don't panic, it was only me doing some tests!
In the (in)famous words of the legendary Alfred E. Newman:
"What? Me worry?"
--
I used to be a heavy gambler. But now I just make mental bets.
That's how I lost my mind.
--------
73 de Brian - N1URO/AFT1BR,
President - EastNet Packet Network
https://www.eastnetpacket.org
email: (see above)
Web: http://www.n1uro.net/
Ampr1: http://n1uro.ampr.org/ (ipv4 AND ipv6)
Ampr2: http://nos.n1uro.ampr.org
Linux Amateur Radio Services
axMail-Fax & URONode
http://uronode.sourceforge.net
http://axmail.sourceforge.net
AmprNet coordinator for:
Connecticut, Delaware, Maine,
Maryland, Massachusetts,
New Hampshire, New Jersey, Pennsylvania,
Rhode Island, and Vermont.
2440
days inactive
2440
days old
6 comments
5 participants
participants (5)
-
Brian -
Chris -
lleachii＠aol.com -
Rial Sloan -
Tom Hayward