[<prev] [next>] [thread-next>] [day] [month] [year] [list]
From: skivebug2 at yahoo.com.sg (Ariesto)
Subject: SQL-worm 1 IP multiple MAC???
Hi all,
I've just found the old SQL-slammer again in my customer network and notice
something that I've never notice before:
The worm sends UDP packet using 1 static spoof source IP and 1 static spoof
dest IP, but the MAC address changes in every packet (mostly the source
mac). What is happening here?? Have anybody notice this before??
Cheers,
-A
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040303/8fa0ca39/attachment.html
Powered by blists - more mailing lists