Re: [Full-disclosure] Weird traffic

Can you provide a pcap with the suspect traffic isolated? Also, what
alerted you to the odd behavior? Did the traffic flag an IDS alert?

bNull

On Wed, Feb 25, 2009 at 9:27 AM, julio sanchez <pete.sanches@xxxxxxxxx>wrote:

Hi,

We're experiencing some weird arp traffic on our network, some box scan
constantly the subnets with loop "who-has" request
All the box are all windows vista sp1 fully patched.
We did format all the supect box, and isolate them on a vlan, to reinstall
vista, updates, kaspersky, then we put it back on the network, and still
some ramdom freshly formated box scanning the network.
We find out that Vista will do an arp scan when it search for a network
printer, but it does this once.
The problem we have is an almost permanent arp scan on various boxs.
We know that some worm was hitting some network around the world with the
smb vulnerability, but all of our boxs are fully updated.
Have you experienced something like this before, or it seems to be legit
traffic ?
Can this be a worm or something related ?

Thanks in advance

Pete

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • [Full-disclosure] Weird traffic
    ... We're experiencing some weird arp traffic on our network, ... All the box are all windows vista sp1 fully patched. ...
    (Full-Disclosure)
  • Re: Emailing web form information to me
    ... To deal with your comments on Vista, it is the mapping via 'my computer' ... or indeed the other bug that causes Publisher to ... have a default folder such as "public_html" that you are supposed to upload ... In the Map Network Drive dialog box, ...
    (microsoft.public.publisher.webdesign)
  • Re: Is any part of Ethernet circuitry tied to Open Firmware? (final post summation)
    ... as much as one can "solve" Vista problems. ... I opened Vistas "Network and Sharing" control panel ... window opened, named "Local Connection Status". ... "Local Connection Status" window closed. ...
    (comp.sys.mac.system)
  • Re: Vista can not see XP
    ... The Network folder also does NOT show the XP. ... but it's not the XP that's not seeing the Vista. ... I am not able to access the Dell XP computer from the HP Vista desktop. ... Local Area Connection 2 Properties, ...
    (microsoft.public.windows.vista.networking_sharing)
  • Re: Not able to ping between SBS 2003 and Vista
    ... I then rebuilt the TCP/IP stack on Vista like you said. ... I just need to double confirm your network topology is as the following: ... Also, when vista pings SBS or SBS pings Vista, the network traffic pass ... ISA server blocks ping for security concern. ...
    (microsoft.public.windows.server.sbs)
Quantcast