Wireshark · Ethereal-users: Re: [Ethereal-users] Capture filters

[Ulf Lamping <ulf.lamping@xxxxxx>]

MH wrote:

>On Fri, Apr 29, 2005 at 12:51:36PM -0400, Rancier, Jeff wrote:
>  
>
>>Can someone explain the following filter (from the Wiki):
>>
>>icmp[icmptype]==icmp-echo and ip[2:2]==92 and icmp[8:4]==0xAAAAAAAA
>>
>>    
>>
>
>Hi Jeff,
>
>The filter looks for an icmp echo request that is 92 bytes long
>and has an icmp payload that begins with 4 bytes of A's (hex).  It is
>the signature of the welchia worm just before it tries to compromise
>a system.
>  
>
I've added this explanation to the wiki page,

Regards, ULFL