Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server.

The traffic shows sequential pings sent to private ranges only. Eg: ...

I have run a virus scan on the server and have used Network Monitor and Wireshark to inspect the outbound packets. I cannot find any process ID associated with the ICMP requests.

The only processes with icmp.dll loaded are winlogon.exe and spoolv.exe.

Can anyone offer any suggestions as to the cause of this traffic or how I might further investigate it?

Thanks in advance!

share|improve this question

Perhaps look at the Sysinternals TCPView Utility. May not work for your situation but the only thing I could think of for the moment.

share|improve this answer
Thanks for the reply but unfortunately I can't seem to identify any ICMP traffic in TCPView. – Ryan Armstrong Aug 16 '12 at 0:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.