Re: pings

[Rodrigo Ramos <rodrigo.ramos () triforsec com br>]

Hi,

What kind of ICMP packets are those? Just echo "8"?
You may try to get these kind of information from another networks?


Best regards,
Rodrigo Ramos
http://www.triforsec.com.br

On Wed, 2004-12-29 at 07:33, cc wrote:
> Leif Ericksen sighed and wrote::
> > Overall I would not worry to much about ping packets noticed in your
> > firewall logs.  Yeah notice them and unless you are seeing hundreds to
> > thousands of packets not a big deal.  I am on a DHCP connection with my
> > ISP and I see various hits in my IDS from PING.  ping hits aer way to
> > common for most people to worry about.
>
> Here's a bit of stats that might put things into a bit of
> a perspective.
>
> Since 18th Feb. 2004, up until now, I've had 188000+ alerts.
> As it stands, 69% of these are ICMP packets.
>
> In the past, when I first installed snort on the firewall,
> most were TCP connects.  Now the majority is ICMPs.
>
> So I'm a little bit perturbed by this...

Attachment: signature.asc
Description: This is a digitally signed message part