RE: ICMP Unreachable IP short header

["Ofir Arkin" <ofir () sys-security com>]

Ralf

If you can send the list the entire tcpdump / snort trace it will be great.
Also, if you wish to have an explanation about ICMP Unreachables you can
read chapter 2 in my paper ICMP Usage In Scanning avilable from:

http://www.sys-security.com/archive/papers/ICMP_Scanning_v3.0.zip
The file size is ~ 1.75mb when zipped

http://www.sys-security.com/archive/papers/ICMP_Scanning_v3.0.pdf
The file size is ~ 5.39mb.

Cheers

Ofir Arkin [ofir () sys-security com]
Founder
The Sys-Security Group
http://www.sys-security.com
PGP CC2C BE53 12C6 C9F2 87B1 B8C6 0DFA CF2D D360 43FA

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Ralf
Hildebrandt
Sent: Monday, June 11, 2001 1:05 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] ICMP Unreachable IP short header



Hi!

Could somebody enlighten me what this is all about:

Jun 10 20:10:31 stahlw06 snort[19661]: ICMP Unreachable IP short header (18
bytes)
Jun 10 20:10:31 stahlw06 snort[19661]: ICMP Unreachable IP short header (18
bytes)

I keep seeing that about twice a day, each day. And I think it is time
to find out what is causing this...

--
ralf.hildebrandt () innominate com                            innominate AG
Technical Consultant                   Don't be afraid of what you see -
Diplom-Informatiker                     be afraid of what you don't see!
tel: +49.(0)7000.POSTFIX                        fax: +49.(0)30.308806-77


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users