How can I look for the Welchia Worm with TCPDUMP? TCPDUMP

republican-creole			Search:
	login · register

	Search for: in all FAQs
All FAQs » TCPDUMP » 5. Some simple scripts » 8447

tcpdump -tnn -i eth0 "icmp[icmptype]==icmp-echo && icmp[8]==0xAA && icmp[9]==0xAA && icmp[10]==0xAA && icmp[11]==0xAA"

Sure can. Try this script. Keep in mind that your sniffer will need to be located where it can see all traffic on your network for this to be useful.


Sunday, 06-Jul 04:50:05	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact 8th year online! © 1999-2008 dslreports.com.