Snort mailing list archives
Re: ICMP Packets.
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Tue, 27 Aug 2002 17:00:55 +1200
On Mon, Aug 26, 2002 at 09:37:12PM -0400, larosa, vjay wrote:
Yeah we were pretty sure that this is some sort of JPEG information in the ICMP packet. I have seen some other activity between ports 88 and 1107 as well with the hosts involved in the ICMP conversations. I did manage to come across another post somewhere else talking about this same kind of activity, this was the post.
All I can say is "me too". However, I've seen it between two internal hosts, so I think it's some spooty ping-type program some app uses - I don't think it's a tunnel. I'd like to know what it is too... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ICMP Packets. larosa, vjay (Aug 26)
- Re: ICMP Packets. Skip Carter (Aug 26)
- Re: ICMP Packets. Jim Burwell (Aug 26)
- <Possible follow-ups>
- RE: ICMP Packets. larosa, vjay (Aug 26)
- Re: ICMP Packets. Jason Haar (Aug 26)
- RE: ICMP Packets. Rich Adamson (Aug 27)
- RE: ICMP Packets. larosa, vjay (Aug 27)
- RE: ICMP Packets. larosa, vjay (Aug 27)
- Re: ICMP Packets. Vinay A. Mahadik (Aug 27)
- Re: ICMP Packets. Matt Kettler (Aug 29)
- Re: ICMP Packets. Vinay A. Mahadik (Aug 27)
- RE: ICMP Packets. larosa, vjay (Aug 29)