This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

am I part of a Ddos

0

I have non stop ICMP requests going from my pc to a server in china. Am I being used as a zombie. if so, any suggestions on stopping it?

asked 30 Oct '14, 23:30

kwwle's gravatar image

kwwle
11●1●1●2
accept rate: 0%

What ICMP requests are those? can you paste an example?

(31 Oct '14, 01:25) mrEEde

One Answer:

0

There are several protocols to communicate with a botnet zombie. ICMP is one option.

http://blog.zeltser.com/post/10755639827/reverse-icmp-shell

So, yes if there is constant ICMP traffic to a host in china and you have no business with that host, then you could have been taken over.

Please upload a capture file somewhere (google drive, dropbox, cloudshark.org) and post the link here.

Regards
Kurt

answered 31 Oct '14, 01:30

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%