Possible Sasser activity?
In the last day or so i have seen a lot of logs stating "ICMP PING NMAP" in my IDS records on my Smoothwall box.
I am just wondering if this is possibly caused by the Sasser worm? I havn`t seen it before and it just seems strange that its suddenly started popping up in my records at the same time as this worm starts to take off.
Has anyone else experienced this?
Possible Sasser activity?
In the last day or so i have seen a lot of logs stating "ICMP PING NMAP" in my IDS records on my Smoothwall box.
I am just wondering if this is possibly caused by the Sasser worm? I havn`t seen it before and it just seems strange that its suddenly started popping up in my records at the same time as this worm starts to take off.
Has anyone else experienced this?
Re: Possible Sasser activity?
Quote:
Originally posted here by homenet
In the last day or so i have seen a lot of logs stating "ICMP PING NMAP" in my IDS records on my Smoothwall box.
I am just wondering if this is possibly caused by the Sasser worm? I havn`t seen it before and it just seems strange that its suddenly started popping up in my records at the same time as this worm starts to take off.
Has anyone else experienced this?
Yes, this is the worm scanning for new hosts to infect.
--TH13
Re: Possible Sasser activity?
Quote:
Originally posted here by homenet
In the last day or so i have seen a lot of logs stating "ICMP PING NMAP" in my IDS records on my Smoothwall box.
I am just wondering if this is possibly caused by the Sasser worm? I havn`t seen it before and it just seems strange that its suddenly started popping up in my records at the same time as this worm starts to take off.
Has anyone else experienced this?
Yes, this is the worm scanning for new hosts to infect.
--TH13