Snort mailing list archives
Re: question about ICMP echo reply (undefinted code) rule
From: Matt Kettler <mkettler () evi-inc com>
Date: Thu, 20 Nov 2003 17:36:23 -0500
At 04:34 PM 11/20/2003, Rob Burris wrote:
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Echo Reply (Undefined Code!)"; itype: 0; sid:409; classtype:misc-activity; rev:4;)But isn't this type of ICMP message expected back from the machine that is replying to the request?
Technically itype 0 icode 0 is expected. itype 0 with any other icode is not.This rule is really meant to be used in conjunction with SID 408... SID 408 picks up the ones with icmp type/code of 0/0, and then 409 picks up everything else.
------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- question about ICMP echo reply (undefinted code) rule Rob Burris (Nov 20)
- Re: question about ICMP echo reply (undefinted code) rule Matt Kettler (Nov 20)
- Re: question about ICMP echo reply (undefinted code) rule Rob Burris (Nov 20)
- Re: question about ICMP echo reply (undefinted code) rule Matt Kettler (Nov 20)