Our web server is under attack for a long time now (at least several months). We get some 50000 ICMP Echo-request messages ("pings") per second. If I have a closer look at them, I can see that almost all of them have the payload text "ICMP echo". The pings come from about 60000 different IP addresses (which, of course, may be spoofed, but I don't think so. Different addresses show different sending patterns).
I checked various ping utilities: Windows ping, hrping, fping, psping, hping and nmap (all under Windows); all of them don't seem to create this payload.
Does anybody have any idea which utility includes this text as payload? I would like to get an idea what is going on. Are we under attack from a botnet? Upset users? Has someone (well, a whole lot of people) misconfigured their software?
Thanks for your help.