TFN Detection

• Look for systems that reply to ICMP_ECHOREPLY packets with id 789 or 123

• Look for ICMP_ECHOREPLY packets with unusual data payloads.

Previous slide

Next slide

Back to first slide

View graphic version