Echo storm
advICE :Intrusions : 2000102

Summary

An abnormally large number of ping packets have been seen in a short period of time.

Details

Pings are how one can tell if another machine on the Internet is running, and how long it takes to respond.

A frequent attack against home users while they are playing games or chatting is to flood them with Ping packets in order to slow down their network connection.

False Positives

We have noticed that a number of applications generate small storms on purpose. They do this in order to more accurately calculate the speed of a user's connection. The one's we've noticed so far are:

• VisualRoute
• NetMeeting
• Net.Medic

We are working on a solution, but in the meanwhile you can edit the configuration file to ignore this intrusion. See Knowledge Base article q000050.

parametric information count The number of pings sent to the same system.

configuration for this item ping.flood.count 20 The number of pings to trigger this intrusion detection. ping.flood.interval 1 The time interval (in seconds) over which the pings are measured.

 
Version appeared: