Snort mailing list archives
Re: single IP icmp alert rule error
From: Erick Mechler <emechler () techometer net>
Date: Thu, 30 Jan 2003 13:24:38 -0800
:: (more or less) :: alert icmp any any -> $HOME_NET any (msg:"test of ping";) :: :: I then issued a ping from a remote machine against 192.168.1.101 .. :: from 192.168.1.100. This worked fine. The log reported the alert. Do you have any NAT going on? Revert your signature to the one above, run the ping again, and look at what hosts are involved in the alert. That might help you figure this out. Cheers - Erick k ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- single IP icmp alert rule error ids (Jan 30)
- Re: single IP icmp alert rule error Erick Mechler (Jan 30)