Erik,
The script I wrote isn't really that smart... It just looks for two IP's
within the same /24 that were sending some kind of ICMP packet to the
victim machine. Since NetFlow logs don't break ICMP down to the type
and codes, I had to unilaterally make that decision. If your network is
clean, I sincerely apologize for any embarrassment or hassle this may
have caused, and I will remove it from the list.
Regards,
Christian