Re: What are the "other" protocols?

[John Sage <jsage () finchhaven com>]

Benny:

These are the rules in my ipchains-based firewall that look for at least 
some "other protocols":

# test for igmp packets
/sbin/ipchains -A input -i $extint -s 0.0.0.0/0 -p 2 -d $extip -j DENY -l
# rule 6
# test for GRE/pptp packets
/sbin/ipchains -A input -i $extint -s 0.0.0.0/0 -p 47 -d $extip -j DENY -l
# rule 7
# test for SIPP-ESP packets
/sbin/ipchains -A input -i $extint -s 0.0.0.0/0 -p 50 -d $extip -j DENY -l
# rule 8
# test for SIPP-AH packets
/sbin/ipchains -A input -i $extint -s 0.0.0.0/0 -p 51 -d $extip -j DENY -l
# rule 9

Protocol numbers are 2, 47, 50, 51.

I see this sort of stuff *very* rarely, mainly igmp and the SIPP stuff.

This may be what you're seeing...

Also see:

ftp://ftp.isi.edu/in-notes/rfc1700.txt

Down about page 7 or so is "Protocol numbers"

HTH...

- John

--
John Sage
FinchHaven, Vashon Island, WA, USA
http://www.finchhaven.com/
mailto:jsage () finchhaven com
"The web is so, like, five minutes ago..."


Jones, Benny wrote:

> Sending a SIGUSR1 to the snort process causes it to
> write some interesting statistics to the system log
> file.  Under the "Breakdown by protocol:" column,
> I find that about 4% of my traffic falls under "other".
>
> What is this?  Is there a way (using snort) to log or
> view it?
>
> (As an aside, on my Solaris 8 sensor, sending 2 successive
> SIGUSR1s to snort will cause the process to abort.)
>
> Thanks in advance.
>
> Benny



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users