A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 an

A worm spoofing 47 source IPs would still generate varied ICMP ID and Seq values per source; identical values across all 77 packets points to a tool setting static fields, not spoofed origins.

A standards-compliant OS ping implementation increments the sequence number with each echo request and uses a unique ICMP ID per session, so two distinct packets will almost never share both values. The fact that 77 packets carry the identical pair (ID:39612, Seq:57072) means a scripted tool or exploit framework hard-coded those fields, which is a classic fingerprint of flood or scanning tools like hping2/hping3. This pattern is used by security analysts to distinguish tool-generated traffic from native OS traffic.

Hosts on the same LAN segment do not share ICMP IDs or sequence numbers; those values are set independently by each sender's network stack.

NAT devices may rewrite source IP addresses but do not zero out ICMP ID and Seq fields; the 13 zero-value packets are more consistent with a different tool or misconfigured ping implementation, not NAT traversal.