From: James Thomason (no email)
Date: Fri Oct 26 2001 - 16:17:38 EDT
On Fri, 26 Oct 2001, Quibell, Marc wrote:
> I believe that the question should be: Why are you pinging me? Tell me what
> admin who sees thousands of ping from one host does not investigation the
> nature? Do mean to say that if you were to log thousands of pings, you would
> ignore them?
> Also many ping attacks start with harmless ping probes.
The example you gave noted 2400 ICMP echo requests in a three hour
period. On most systems I have worked with, the standard ping utility
sends ICMP echo requests at a rate of one per second. This is 3600 echo
requests per hour, 10800 in a three hour period.
In my experience, is fairly common place to leave ping running for
extended periods of time to observe network performance and detect
I would think this number of echo requests from a single host in such a
timeframe is hardly abnormal, and I could care less.
Should I receive 10800 echo requests in less than a minute I could become
concerned, depending on the popularity of the system in question.
> -----Original Message-----
> From: James Thomason [mailto:]
> Sent: Friday, October 26, 2001 3:00 PM
> To: Patrick W. Gilmore
> Cc: ; Quibell, Marc
> Subject: RE: [SOT Rant] Non-hostile probes / opt-in/out
> If I did, and they responded negatively, I would tell them YOU said it was
> a good idea.
> Seriously, why should the administrators of *.army.mil care if I test
> packet response time between our networks? Is this an illegal activity I
> am unaware of?
> On Fri, 26 Oct 2001, Patrick W. Gilmore wrote:
> > At 02:16 PM 10/26/2001 -0500, Quibell, Marc wrote:
> > >
> > >Maybe you should ping NS01.ARMY.MIL about 2400 times in 3 hour and see
> > >you don't get a visit? Pinging a website 2 times means nothing..
> > How about 441 times in 2 hours? :)
> > >Marc
> > --
> > TTFN,
> > patrick