The following are Ping Sweep signatures:
- 2100—ICMP network sweep with Echo
(severity 5, reconnaissance): This signature is triggered when IP
datagrams are received directed at multiple hosts on the network
with the "protocol" field of the IP header set to 1 (ICMP)
and the "type" field in the ICMP header set to 8 (Echo
Request). This is indicative that a reconnaissance sweep of your
network may be in progress. This may be the prelude to a more
serious attack.
- 2101—ICMP network sweep with
Timestamp (severity 5, reconnaissance): This signature is
triggered when IP datagrams are received directed at multiple
hosts on the network with the "protocol" field of the IP
header set to 1 (ICMP) and the "type" field in the ICMP
header set to 13 (Timestamp Request). This is indicative that a
reconnaissance sweep of your network may be in progress. This may
be the prelude to a more serious attack.
- 2102—ICMP network sweep with
Address Mask (severity 5, reconnaissance): This signature is
triggered when IP datagrams are received directed at multiple
hosts on the network with the "protocol" field of the IP
header set to 1 (ICMP) and the type field in the ICMP header set
to 17 (Address Mask Request). This is indicative that a
reconnaissance sweep of your network may be in progress. This may
be the prelude to a more serious attack.
|
|
