As Sans pointed out, few administrators program their defences to highlight ping responses. And when Sans looked at participants' logs, it began to worry. Inverse mapping allows crackers to map what lies behind a firewall even if the firewall is denying access to most network traffic. That is because most routers and firewalls react to a ping response packet by doing nothing, unless the destination machine is unavailable. In the latter case they send the originating machine a 'host unreachable' signal.
Crackers use the lack of response as a telltale sign that a machine is there.
Marchany's reference to clandestine channels is more disturbing. He believes the latest findings could be the first real-world example of a Loki, Trinoo or Tribal Flood attack. All three are variants of the classic denial of service attack. But instead of sending packets from the cracker's own computer, these exotic variants allow Trojans on distributed networks to do the work for him. The result is that the force of the attack is multiplied, the job of stopping each source is magnified and the real originator remains anonymous.