Wireshark · Ethereal-users: Re: [Ethereal-users] Capture filters

[MH <procana@xxxxxxxxxxxxxx>]

On Fri, Apr 29, 2005 at 12:51:36PM -0400, Rancier, Jeff wrote:
> Can someone explain the following filter (from the Wiki):
> 
> icmp[icmptype]==icmp-echo and ip[2:2]==92 and icmp[8:4]==0xAAAAAAAA
>

Hi Jeff,

The filter looks for an icmp echo request that is 92 bytes long
and has an icmp payload that begins with 4 bytes of A's (hex).  It is
the signature of the welchia worm just before it tries to compromise
a system.

Hope this helps,
Mike