Ping sweep
advICE :Intrusions : 2000106

Summary

A potential intruder is scanning your systems to see which ones are up and running.

Details

The "ping sweep" is one of the most classic hacker activities on the Internet. The hacker scans the network looking for machines that are alive, and which can be attacked.

False Positives

Network management systems sometimes send these requests, If you have such a system, you should verify that the address of the intruder matches the address of your management system. You can trust this report from a particular address by using the trust.pair configuration option.

configuration for this item pingsweep.h-threshold 4 The number of different IP destination addresses to trigger an intrusion detection.

 
Version appeared: