ICMP Echo Flood on cable modem

Archived from groups: comp.security.firewalls (More info?)

I have Charter cable and for months I have been receiving a flood of
ICMP ECHO messages pretty much continuously. Rates have been observed
from 300 to 1000 packets a minute.

All of the packets checked are identical except for the Reply To IP
address and the checksum. All the FROM addresses are 127.0.0.1 and the
TO addresses are addresses in my regional Charter cable domain.

Here's a sample packet:

45 00 00 26 8F 0E 40 00 FF 01 2C 9F 7F 00 00 01
44 73 FC B4 08 00 D8 D7 04 D2 00 00 31 F9 24 44
00 06 BC 09 08 09

I'm behind a NAT router that doesn't reply to PINGS.

What is this?

Kevin

[PS. I called Charter and they said to file an abuse complaint which I
did (without effect).]

Archived from groups: comp.security.firewalls (More info?)

I've ask a similar question recently after snort on my OpenBSD firewall
snatched some packets from 127.0.0.1:80 to external ip address between
1000 to 2000
Someone mentioned that is what blaster does. Blaster will send spoof
packets like that.

Calyth