Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server.

The traffic shows sequential pings sent to private ranges only. Eg: 192.168.1.1 192.168.1.2 192.168.1.3 ... 192.168.255.254

I have run a virus scan on the server and have used Network Monitor and Wireshark to inspect the outbound packets. I cannot find any process ID associated with the ICMP requests.

The only processes with icmp.dll loaded are winlogon.exe and spoolv.exe.

Can anyone offer any suggestions as to the cause of this traffic or how I might further investigate it?

Thanks in advance!

share|improve this question

1 Answer 1

Perhaps look at the Sysinternals TCPView Utility. May not work for your situation but the only thing I could think of for the moment.

share|improve this answer
    
Thanks for the reply but unfortunately I can't seem to identify any ICMP traffic in TCPView. –  Ryan Armstrong Aug 16 '12 at 0:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.