[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-Disclosure] SQL-worm 1 IP multiple MAC???

To: <full-disclosure@xxxxxxxxxxxxxxxx>
Subject: [Full-Disclosure] SQL-worm 1 IP multiple MAC???
From: "Ariesto" <skivebug2@xxxxxxxxxxxx>
Date: Wed, 3 Mar 2004 08:31:43 +0800

Hi all,

 

I've just found the old SQL-slammer again in my customer network and notice
something that I've never notice before:

 

The worm sends UDP packet using 1 static spoof source IP and 1 static spoof
dest IP, but the MAC address changes in every packet (mostly the source
mac).  What is happening here??  Have anybody notice this before?? 

 

Cheers,

 

-A

Follow-Ups:
- Re: [Full-Disclosure] SQL-worm 1 IP multiple MAC???
  - From: Christopher Carey

Prev by Date: Re: [Full-Disclosure] Re: Authentication flaw in Web Wiz forum
Next by Date: [Full-Disclosure] recursive DNS issue
Previous by thread: [Full-Disclosure] Re: iDEFENSE Security Advisory 03.02.04: FreeBSD Memory Buffer Exhaustion Denial of Service Vulnerability
Next by thread: Re: [Full-Disclosure] SQL-worm 1 IP multiple MAC???
Index(es):
- Date
- Thread