For Any Network Gurus.... Ping of Death

heybrad · 10-22-2003, 12:55 PM

This place has a lot of smart people, so I figured I'd post this here since there has to be some IT guys.

Heres the story... I'm working with an outsider who is sending a file to my server every Monday morning. At the exact time he sends the file (whether he sends it FTP or just attaches to an email) he gets a message that shows my server is sending him a Ping of Death (the times match exactly every time). I'm familiar with Ping of Death in that it is triggered by what a system considers to be odd size packets. Having done a little research I found that the Ping of Death can be detected through innocent activites such as FTP or other protocols. In other words, its not a completely accurate error. He insists that I have a scheduled job that is pinging him at the same time. I say thats ridiculous, but I've checked the job scheduler and theres no such job. I even went as far as searching every program written on that server to find his IP address, hoping I would find a program thats kicking off that somehow I missed.

I guess what I'm looking for is additional outsider idea sof what exactly Ping of Death is to see if maybe I'm misinterpreting it. The guy I'm working with is extremely stubborn and isnt listening to what I'm telling him anyways, but it will make me feel better if I can be reassured that I understand Ping of Death and that it could be an invalid error.

Any help is appreciated.

John Galt · 10-22-2003, 12:57 PM

I have no help - I'm just amazed that there is something called the "Ping of Death." That's cool.

John Galt · 10-22-2003, 12:59 PM

dola,

It makes me think of the movie, "The Ring" applied to the internet. It is a Ping that is so evil that when you receive it you die a week later.

OK - I need to go back to work now.

Sloan · 10-22-2003, 02:23 PM

How is he sending you this file? (program, protocol, etc.)

What is your operating system? His?

Do you have logging software on your system to see what traffic is coming in and out of your server? Is your system contacting his? It isn't that hard for someone to "spoof" their IP address to make an attack look like it is coming from you.

heybrad · 10-22-2003, 02:29 PM

We are on an AS400 using OS400. He wont tell me what he is on. He has sent the file using FTP and received the Ping of Death in his log. He stopped using FTP altogether and sent the file attached in an email. Again, he got the Ping of Death in his log. The times matched exactly with the time he started the transaction. Its as if any TCP activity between our servers produces the Ping of Death for him.

On an AS400 we can see every job that started and when it stopped whether its system produced or a program we wrote. There is nothing in the job scheduler even close to the time it happens and we searched all history files and found nothing happening around that time.

As far as network tools to see whats going on, like a trace... well, we dont have them and our ISP wasnt willing to do this at the ISP level.

EagleFan · 10-22-2003, 02:35 PM

heybrad, you should be able to run a trace on the 400 that should capture what is being sent and received. Just be careful with running it too long or the log could start to eat up resources if you have a lot of activity going on.

heybrad · 10-22-2003, 03:56 PM

I hadnt thought of that. Thanks Eaglefan. And you're right about the logs. We've run a trace before and they get huge fast.

sterlingice · 10-23-2003, 04:57 PM

Any update on this? I was quite curious about the story.

SI

heybrad · 10-23-2003, 05:17 PM

Funny you should ask. I'm on the phone with our ISP right now. Everyone I've talked to still says that Ping of Death is an unreliable error message. I found an article that talked about the IT security industry overreaction to packet size issues which is right in line with this problem.

Dutch · 10-23-2003, 06:26 PM

Does he have the proper logon and password for FTPing and does the server have an FTP account associated with the folder? Maybe he is trying to send and is getting rejected for inproper security?

Or maybe he is having a virus or something that has the server send him a ping of death everytime he tries to use the FTP port.

I'm just guessing since I have never seen this stuff before.

Try just restarting both the server and the client machine for starters (if you haven't already).

Good luck and tell us how it goes.

10-22-2003, 12:57 PM	#2
John Galt Pro Starter Join Date: Oct 2000 Location: The Internets	I have no help - I'm just amazed that there is something called the "Ping of Death." That's cool. __________________ I do mind, the Dude minds. This will not stand, ya know, this aggression will not stand, man. - The Dude

10-22-2003, 12:59 PM	#3
John Galt Pro Starter Join Date: Oct 2000 Location: The Internets	dola, It makes me think of the movie, "The Ring" applied to the internet. It is a Ping that is so evil that when you receive it you die a week later. OK - I need to go back to work now. __________________ I do mind, the Dude minds. This will not stand, ya know, this aggression will not stand, man. - The Dude

10-22-2003, 02:35 PM	#6
EagleFan Hall Of Famer Join Date: Nov 2000 Location: Mays Landing, NJ USA	heybrad, you should be able to run a trace on the 400 that should capture what is being sent and received. Just be careful with running it too long or the log could start to eat up resources if you have a lot of activity going on. __________________ The EagleFan YouTube Channel - Reactions Soarin' & Scratchin' YouTube Channel - We react to music, videos, TV, we talk, we are planning some field trips Soarin' & Soothin' - Meditation, Relaxation, and Sleep Aid; mental health is important

10-23-2003, 04:57 PM	#8
sterlingice Hall Of Famer Join Date: Apr 2002 Location: Back in Houston!	Any update on this? I was quite curious about the story. SI __________________ Houston Hippopotami, III.3: 20th Anniversary Thread - All former HT players are encouraged to check it out! Janos: "Only America could produce an imbecile of your caliber!" Freakazoid: "That's because we make lots of things better than other people!" Last edited by sterlingice : 10-23-2003 at 04:57 PM.

10-22-2003, 02:23 PM	#4
Sloan High School JV Join Date: Oct 2001 Location: Michigan	How is he sending you this file? (program, protocol, etc.) What is your operating system? His? Do you have logging software on your system to see what traffic is coming in and out of your server? Is your system contacting his? It isn't that hard for someone to "spoof" their IP address to make an attack look like it is coming from you.

10-22-2003, 02:29 PM	#5
heybrad Norm!!! Join Date: Nov 2000 Location: Manassas, VA	We are on an AS400 using OS400. He wont tell me what he is on. He has sent the file using FTP and received the Ping of Death in his log. He stopped using FTP altogether and sent the file attached in an email. Again, he got the Ping of Death in his log. The times matched exactly with the time he started the transaction. Its as if any TCP activity between our servers produces the Ping of Death for him. On an AS400 we can see every job that started and when it stopped whether its system produced or a program we wrote. There is nothing in the job scheduler even close to the time it happens and we searched all history files and found nothing happening around that time. As far as network tools to see whats going on, like a trace... well, we dont have them and our ISP wasnt willing to do this at the ISP level.

10-22-2003, 03:56 PM	#7
heybrad Norm!!! Join Date: Nov 2000 Location: Manassas, VA	I hadnt thought of that. Thanks Eaglefan. And you're right about the logs. We've run a trace before and they get huge fast.

10-23-2003, 05:17 PM	#9
heybrad Norm!!! Join Date: Nov 2000 Location: Manassas, VA	Funny you should ask. I'm on the phone with our ISP right now. Everyone I've talked to still says that Ping of Death is an unreliable error message. I found an article that talked about the IT security industry overreaction to packet size issues which is right in line with this problem.

10-23-2003, 06:26 PM	#10
Dutch "Dutch" Join Date: Oct 2000 Location: Tampa, FL	Does he have the proper logon and password for FTPing and does the server have an FTP account associated with the folder? Maybe he is trying to send and is getting rejected for inproper security? Or maybe he is having a virus or something that has the server send him a ping of death everytime he tries to use the FTP port. I'm just guessing since I have never seen this stuff before. Try just restarting both the server and the client machine for starters (if you haven't already). Good luck and tell us how it goes.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)