0

This seems to occur when I initiate a connection to an IP that I haven't previously before.

Is this a botnet trying to say hi to his friends?

As you can see I have an ip filter set in this image, it takes roughly 30-40 seconds for it to rack up that much ICMP traffic.. is there a windows service that does this? And if so for what reason exactly?

http://imgur.com/rrF3NNM

Improve this question
5
  • 1
    Those are not normal pings. Exactly what did you do to communicate with this hidden IP address?
    – Michael Hampton
    Jul 29, 2014 at 3:15
  • Can you post the full packet capture?
    – Grant
    Jul 29, 2014 at 3:18
  • it's a simple chat relay program I am working on with a friend. I noticed them yesterday. I tested on another machine and it does not seem to happen whatsoever.. if it means anything, our chat relay is just some custom application layer protocol using TCP.
    – user40262
    Jul 29, 2014 at 3:19
  • If you intend on hiding the IP address in the image, you may want to also hide it in the packet capture bytes displayed in the ICMP payload you have selected. Simply convert your source IP to hexadeciaml, look for the 4 bytes representing it, then mask the next 4 bytes in the packet, stopping at and masking 0xB2 (178).
    – Michael J. Gray
    Jul 29, 2014 at 4:36
  • I believe you can use Network Monitor or Process Monitor to identify which process ID is sending the ICMP packet.
    – DarkMoon
    Jul 29, 2014 at 8:57

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .