Ulkoa tarjotaan tällaista pakettia mikä se on?
File Version : 4.90.3000
File Description : NETBEUI Virtual Device (Version 4.0)
File Path : C:WINDOWSSYSTEM
etbeui.vxd
Connection origin : remote initiated
Protocol : ICMP
Local Address : 80.222.232.180
ICMP Type : 8 (Echo Request)
ICMP Code : 0
Remote Name :
Remote Address : 80.222.2.48
Ethernet packet details:
Ethernet II (Packet Length: 108)
Destination: 00-89-75-17-11-d8
Source: 00-04-4e-17-68-1c
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 125
Protocol: 0x1 (ICMP - Internet Control Message Protocol)
Header checksum: 0x25e3 (Correct)
Source: 80.222.2.48
Destination: 80.222.232.180
Internet Control Message Protocol
Type: 8 (Echo Request)
Code: 0
Data (68 bytes)
Binary dump of the packet:
0000: 00 89 75 17 11 D8 00 04 : 4E 17 68 1C 08 00 45 00 | ........N.h...E.
0010: 00 5C E0 02 00 00 7D 01 : E3 25 50 DE 02 30 50 DE | .....}..%P..0P.
0020: D6 8C 08 00 F7 1E 02 00 : A9 8B AA AA AA AA AA AA | ................
0030: AA AA AA AA AA AA AA AA : AA AA AA AA AA AA AA AA | ................
0040: AA AA AA AA AA AA AA AA : AA AA AA AA AA AA AA AA | ................
0050: AA AA AA AA AA AA AA AA : AA AA AA AA AA AA AA AA | ................
0060: AA AA AA AA AA AA AA AA : AA AA 00 00 | ............
File Version : 4.90.3000
File Description : NETBEUI Virtual Device (Version 4.0)
File Path : C:WINDOWSSYSTEM
etbeui.vxd
Connection origin : remote initiated
Protocol : ICMP
Local Address : 80.222.232.180
ICMP Type : 8 (Echo Request)
ICMP Code : 0
Remote Name :
Remote Address : 80.222.2.48
Ethernet packet details:
Ethernet II (Packet Length: 108)
Destination: 00-89-75-17-11-d8
Source: 00-04-4e-17-68-1c
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 125
Protocol: 0x1 (ICMP - Internet Control Message Protocol)
Header checksum: 0x25e3 (Correct)
Source: 80.222.2.48
Destination: 80.222.232.180
Internet Control Message Protocol
Type: 8 (Echo Request)
Code: 0
Data (68 bytes)
Binary dump of the packet:
0000: 00 89 75 17 11 D8 00 04 : 4E 17 68 1C 08 00 45 00 | ........N.h...E.
0010: 00 5C E0 02 00 00 7D 01 : E3 25 50 DE 02 30 50 DE | .....}..%P..0P.
0020: D6 8C 08 00 F7 1E 02 00 : A9 8B AA AA AA AA AA AA | ................
0030: AA AA AA AA AA AA AA AA : AA AA AA AA AA AA AA AA | ................
0040: AA AA AA AA AA AA AA AA : AA AA AA AA AA AA AA AA | ................
0050: AA AA AA AA AA AA AA AA : AA AA AA AA AA AA AA AA | ................
0060: AA AA AA AA AA AA AA AA : AA AA 00 00 | ............
Vastaukset 3
Vanhimmat
Onkos sulla Soneran laajakaista. Tuo näyttäisi olevan Soneran palvelimelta kysely koneellesi että vieläkö olet linjoilla.
ICMP Type 8 (Echo Request) Code 0, tunnetaan kansan kielellä myös pinginä (tuo on tarkemmin se ensimmäinen kyselypaketti yhdessä pingaustoimenpiteessä, kone lähettää Echo Replyn, jos se haluaa vastata Echo Requestiin).
Vaikuttaa Nachia/Welchi viruksen tekemältä scannaukselta. Ko. pöpö lähettää tuollaisia viestejä etsiessään koneita joihin levitä.
Lisätietoja:
http://www.europe.f-secure.com/v-descs/welchi.shtml
http://isc.sans.org/diary.html
http://slashdot.org/article.pl?sid=03/08/18/1722203