How can I look for the Welchia Worm with TCPDUMP? TCPDUMP | DSLReports.com, ISP Information

republican-creole	site Search:
login · register

FAQs

how-to block ads

	Search for: in all FAQs
All FAQs » TCPDUMP » 5. Some simple scripts

This Section

How do I show the MAC address in the capture?
How can I look for the Welchia Worm with TCPDUMP?
How can I show ALL traffic on a specified interface?
How can I capture a specified number of packets?
** Note about these examples and TCPDUMP **
How can I use TCPDUMP to determine the top talker on my network?

How can I look for the Welchia Worm with TCPDUMP?

tcpdump -tnn -i eth0 "icmp[icmptype]==icmp-echo && icmp[8]==0xAA && icmp[9]==0xAA && icmp[10]==0xAA && icmp[11]==0xAA"

Sure can. Try this script. Keep in mind that your sniffer will need to be located where it can see all traffic on your network for this to be useful.

by state

Saturday, 11-Feb 21:04:49

Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 12.5 years online! © 1999-2012 dslreports.com.