All,
I've noticed some pings from portal.ampr.org:
2017-09-11 17:32:25.846 48.191 ICMP 81.174.235.134:0 -> 44.60.44.10:8.0 38 3192 1
Is this an automated software pinging?
- Lynwood KB3VWG
On Tue, Sep 12, 2017 at 11:36 AM, lleachii--- via 44Net 44net@hamradio.ucsd.edu wrote:
All,
I've noticed some pings from portal.ampr.org:
2017-09-11 17:32:25.846 48.191 ICMP 81.174.235.134:0 -> 44.60.44.10:8.0 38 3192 1
Is this an automated software pinging?
- Lynwood
KB3VWG
It's an AMPRNet ICMP amplification attack. The way it works is every time there is ICMP traffic on AMPRNet, someone reports it to this mailing list. Then there are usually a few replies. This has the effect of turning 64 bytes of ICMP into a storm of SMTP TCP traffic.
Tom KD7LXL
It's an AMPRNet ICMP amplification attack. The way it works is every time there is ICMP traffic on AMPRNet, someone reports it to this mailing list. Then there are usually a few replies. This has the effect of turning 64 bytes of ICMP into a storm of SMTP TCP traffic.
I don't care who you are, that's funny.
Tom;
On Tue, 2017-09-12 at 11:59 -0700, Tom Hayward wrote:
It's an AMPRNet ICMP amplification attack. The way it works is every time there is ICMP traffic on AMPRNet, someone reports it to this mailing list. Then there are usually a few replies. This has the effect of turning 64 bytes of ICMP into a storm of SMTP TCP traffic.
Is this like a nagios alarm? ;->
OK...
I'm guessing Tom's reply was in jest...???
If the server can be checked *if the behavior is unknown,* that would be appreciated.
Servers shouldn't start exhibiting new behaviors by themselves (i.e. pinging people without interaction from the operator).
73,
- KB3VWG
The way it works is every time there is ICMP traffic on AMPRNet, someone reports it to this mailing list.
Don't panic, it was only me doing some tests!
Chris
Sent from my iPhone
On 12 Sep 2017, at 19:36, lleachii--- via 44Net 44net@hamradio.ucsd.edu wrote:
All,
I've noticed some pings from portal.ampr.org:
2017-09-11 17:32:25.846 48.191 ICMP 81.174.235.134:0 -> 44.60.44.10:8.0 38 3192 1
Is this an automated software pinging?
- Lynwood
KB3VWG
44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net
Chris;
On Tue, 2017-09-12 at 20:44 +0100, Chris via 44Net wrote:
Don't panic, it was only me doing some tests!
In the (in)famous words of the legendary Alfred E. Newman: "What? Me worry?"
-
Brian -
Chris -
lleachii＠aol.com -
Rial Sloan -
Tom Hayward