full-disclosure - Weird traffic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 25 Feb 2009 10:27:26 -0500
From: julio sanchez <pete.sanches@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Weird traffic

Hi,

We're experiencing some weird arp traffic on our network, some box scan
constantly the subnets with loop "who-has" request
All the box are all windows vista sp1 fully patched.
We did format all the  supect box, and isolate them on a vlan, to reinstall
vista, updates, kaspersky, then we put it back on the network, and still
some ramdom freshly formated box scanning the network.
We find out that Vista will do an arp scan when it search for a network
printer, but it does this once.
The problem we have is an almost permanent arp scan on various boxs.
We know that some worm was hitting some network around the world with the
smb vulnerability, but all of our boxs are fully updated.
Have you experienced something like this before, or it seems to be legit
traffic ?
Can this be a worm or something related ?

Thanks in advance

Pete

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/