Network card flooding network with ICMP Echo requests

[Cole Shelton]

Hi all,

I have a Win2K comp that is on my home network with another computer running
XP. I have DSL and a LinkSys BEFSR41 router.

I noticed a few days ago that the the traffic on my DSL router was showing
the connection was always busy. I tracked the problem to my Win2K. I then
used a packet sniffer to see what was going on. My box was sending out ICMP
Echo request to every network Address (192.168.x.x). I thought I had some
sort of virus and had been planning ot upgrade it to XP anyway, so I wiped
the box and then installed XP. When I booted XP, I had the same problem!

A friend of mine told me he had heard of bad network cards doing something
like this, so I swapped out the network card with one I knew was good. No
luck. Then I even switched the PCI slot for kicks, still no luck.

I again thought maybe there was some kind of virus. But I killed every
single Non-Critical process and it was still flooding the network. Only
when I disable the network connection or kill explorer does it stop.

I have run out of ideas. Does anyone have any idea what could be causing
this?

TIA
Cole

 

[Semper]

Interesting!!! For the last couple of months I have been recieving a
load of ICMP Echo requests. So many in a day I thought I was under
attack. I make every effort to make sure I am virus and trojan free.
It became so much of a concern I called my ISP several times. I was
reassured that because my software firewall was set to block them I
was OK. I use Norton Internet security and Sygate (which gives me a
great readable log). Recently I setup a M$ wired router and all of
those ICMP Echo requests have dissapeared. I am a happy camper now.
I have no idea why so many were being recieved but they were coming
from every major ISP in the US. I noticed this after we had been
subjected to the recent WORM attacks. Since many of us have patched
our systems, I feel there are some holdouts that have not. Although
from your post I can see that you have an internal problem and mine
was external, I will try to follow this thread. These kind of
anomalies pique my interest.
Good luck in solving your problem and I do hope others report back
with a solution.