Re: What Rule??

[Jeff Nathan <jeff () snort org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Those errors are generated by the actual packet decoder.  It's neither a 
rule or preprocessor.

- -Jeff

- --On Saturday, February 15, 2003 21:59:37 -0600 "Akerson, Jeff" 
<jakerson () Bemis com> wrote:

> Hi All
>
> Can anyone tell me what is triggering this:
>
> [**] [116:108:1] (snort_decoder) Unknown Datagram decoding problem! [**]
> 02/16-03:48:22.800777 10.67.8.137 -> 10.67.252.20
> ICMP TTL:128 TOS:0x0 ID:32253 IpLen:20 DgmLen:31
> Type:3  Code:3  DESTINATION UNREACHABLE: PORT UNREACHABLE
> ORIGINAL DATAGRAM TRUNCATED
>
> Is this coming from a rule or a preprocessor?
>
> 10.67.8.137 is a data collector for IP based security cameras 10.67.252.20
> is a camera
>
> Thanks!
> Jeff
>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


- --
http://www.snort.org/~jeff       (pgp key available)
"Great spirits have always encountered violent opposition from mediocre
minds."
- - Albert Einstein
    
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE+UBgYEqr8+Gkj0/0RAp0xAJ921lRtlWxwPrnqA9/8l8DvERRwjgCeIZpK
rIw+VzPEo0Ub8BzGwVLLIlU=
=+2Zd
-----END PGP SIGNATURE-----



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users