Snort mailing list archives
Re: Embedded Fragment?
From: Glenn Forbes Fleming Larratt <glratt () is rice edu>
Date: Wed, 20 Feb 2002 01:07:44 -0600 (CST)
On Tue, 19 Feb 2002, Daniel Holden wrote:
Can someone tell me (or point me to the docs) what the following means? Feb 19 21:52:52 crow kernel: ipt_unclean: (embedded packet) Embedded fragment. Feb 19 21:52:51 crow kernel: IN=eth0 OUT= MAC=uglyMacAddressHere SRC=192.5.4.146 DST=209.142.39.160 LEN=56 TOS=0x00 PREC=0x00 TTL=245 ID=22342 DF PROTO=ICMP TYPE=3 CODE=13 [SRC=209.142.39.160 DST=204.152.187.2 LEN=64 TOS=0x00 PREC=0x00 TTL=55 ID=47316 FRAG:64 PROTO=TCP ]
It's opaque to me whether your system "crow" is generating, recording, or dropping the packet in question, but: - The packet itself is an ICMP 3/13 packet, meaning type 3, code 13 (see http://www.iana.org/assignments/icmp-parameters); type 3 is "destination unreachable", code 13 is "Communication Administratively Prohibited", i.e. an ACL, probably on host 192.5.4.146, dropped a packet from host 209.142.39.160. - A truncated portion of the packet that was dropped is included *within* the ICMP packet; enough to discern that it was a 64-byte fragment of a TCP packet, from host 209.142.39.160 to host 204.152.187.2 . - What's it all mean? A 64-byte fragment either implies a final fragment or an extraordinarily short-MTU segment in the path - or crafted fragmentation for some probably unfriendly purpose. Need more data (like a hex dump - from Snort ;) . -g
Thank you Daniel Holden dholden () idsb net http://www.idsb.net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Glenn Forbes Fleming Larratt glratt () rice edu http://is.rice.edu/~glratt There are imaginary bugs to chase in heaven. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Embedded Fragment? Daniel Holden (Feb 19)
- Re: Embedded Fragment? Glenn Forbes Fleming Larratt (Feb 19)
- Re: Embedded Fragment? Daniel Holden (Feb 19)
- Re: Embedded Fragment? Glenn Forbes Fleming Larratt (Feb 19)