2000012

	Ping of death
advICE :Intrusions : 2000012

FAQ

Oh my gosh, I'm being HACKED!!!

How do I report the hacker to my ISP?

I'm seeing lots of attacks, is this normal?

Summary
This indicated an attempt to crash your system.
Details
A TCP/IP packet with a theoretical length greater than 65536-bytes has been sent to the machine. This attack was popular around July of 1997, but since then most systems have been patched to prevent this bug.
TCP/IP supports a feature called "fragmentation", where a single IP-packet can be broken down into smaller segments. This is needed because the typical Internet connection (dial-up, Ethernet, cable-modem, etc.) only supports packets of around a couple thousand bytes, but IP supports packets up to 64-kbytes. Thus, when sending a single packet that is too large for a link, it is broken up into smaller packet fragments.
A quirk of IP is that while a single packet cannot exceed 65536-bytes, the fragments themselves can add up to more than that. The "Ping of Death" technique does just that. Since this is a condition thought impossible, operating systems crash when they receive this data.
Ping of death can actually be run from older versions of Windows. At a command line, simply type: ping -l 65550 VICTIM A further bug in Windows is that it not only crashes when it receives the invalid data, but it can accidentally also generate it. Newer versions of Windows prevent you from sending these packets.
Spoofing
Ping-of-Death packets are easily spoofed, so you cannot rely upon the IP address of the sender.
Aliases
There are lots of variants to this attack: jolt, sPING, ICMP bug, IceNewk, Ping o' Death

more information

CERT: CA-96.26.ping Denial-of-Service Attack via ping
q154174 Invalid ICMP Datagram Fragments Hang Windows NT, Windows 95
spoofing: More about how to fake your own IP address.
BugtraqID: 1236 Microsoft Windows 9x / NT 4.0 / 2000 Fragmented IP Packets DoS Vulnerability (Jolt attack): The Microsoft TCP/IP stack will grind to a halt if it receives many pings of death; by default, the product prevents this problem because these frames are not passed onto the Microsoft stack.
BugtraqID: 1240 Cayman 3220H DSL Router "ping of death" Vulnerability
Ping o' Death Page
Ping: More about the normal "ping" command.
MacInTouch Special Report: How ping-of-death affects the Macintosh.
WinPlanet: Net Exploits
CVE-1999-0128 Ping o' Death
CVE-2000-0418 Cayman 3220-H DSL router vulnerable to ping-of-death

 
Version appeared: