Hello to all

I just started to work with snort 1.9.0. I have it install on Windows 2000.
I am currently just using the base rule set that it comes with. I have not
received any alerts same of yet. I thought the snort.conf that comes with
1.9.0 would be good enough to pick up on many intrusions. I do receive a lot
of these types 5 and type 8 messages. Is this somewhat normal?

01/06-14:13:32.853486 xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx

ICMP TTL:64 TOS:0x0 ID:62730 IpLen:20 DgmLen:56

Type:5 Code:1 REDIRECT HOST NEW GW: xxx.xxx.xxx.xxx

** ORIGINAL DATAGRAM DUMP:

01/07-03:24:59.285871 64.94.33.74 -> xxx.xxx.xxx.xxx

ICMP TTL:53 TOS:0x0 ID:0 IpLen:20 DgmLen:84 DF

Type:8 Code:0 ID:1784 Seq:36951 ECHO

Thanks

JS

-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]