Most likely, the updated file has been placed on a compromised system without the administrator's knowledge. They use ICMP ID field value 666 for the handler and ICMP ID field value 667 for the agent. You should be able to capture this type of traffic with a well-written filter for network analyzers. To detect such Stacheldraht attacks, you can download a program that Dave Dittrich, Marcus Ranum, and others have written. For example, in Figure 3, host 10.1.0.2 appears to be performing a port scan on host 10.1.0.1.
Port scanning is used to determine what daemons or processes are running on a device.
The device performing the scan sends a series of packets with different destination port numbers. Based on the replies received, this device can build a list of active ports. A hacker uses port scanning to find out which ports are active. Typically a randomizing feature is used to camouflage port scanning activity. Now that the scanner and, therefore, the hacker know the ports that are active, the hacker can begin to exploit these services and look for weaknesses.