lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <1078281618.31078.10.camel@spacely> From: security at securespot.com (Christopher Carey) Subject: SQL-worm 1 IP multiple MAC??? Possibly: This MAC Flooding is an ARP Cache Poisoning technique aimed at network switches. When certain switches are overloaded they often drop into a "hub" mode. In "hub" mode, the switch is too busy to enforce its port security features and just broadcasts all network traffic to every computer in your network. Chris Carey On Tue, 2004-03-02 at 17:31, Ariesto wrote: > Hi all, > > > > I’ve just found the old SQL-slammer again in my customer network and > notice something that I’ve never notice before: > > > > The worm sends UDP packet using 1 static spoof source IP and 1 static > spoof dest IP, but the MAC address changes in every packet (mostly the > source mac). What is happening here?? Have anybody notice this > before?? > > > > Cheers, > > > > -A > >
Powered by blists - more mailing lists