(In a group enterprise, the network exit of a district connected to the head office experienced intermittent slow access, and the problem elements could not be located. Intranet monitoring found the diagnosis information of suspected worm virus analysis. Several IP addresses send many ICMP packets, and the intended addresses of the ICMP packets are all random multicast addresses. . .)