Snort mailing list archives
Stopping ECHO & ECHO REPLY Alerts
From: Michael Pace <mpace79 () yahoo com>
Date: Wed, 11 Aug 2004 06:24:45 -0700 (PDT)
I am currently seeing hundreds of the alerts below, but I'm not sure what rule is causing them. I don't really care to have an email sent to me every time someone does a basic echo request on my firewall. I'd like to change the rule to log instead of alert. Can anyone tell me where to look? [Classification: Misc activity] [Priority: 3] 08/11-07:29:02.490037 63.163.102.37 -> xxx.xxx.xxx.xxx ICMP TTL:49 TOS:0x0 ID:27096 IpLen:20 DgmLen:64 Type:8 Code:0 ID:28958 Seq:512 ECHO [Classification: Misc activity] [Priority: 3] 08/11-07:29:49.362139 216.15.147.20 -> xxx.xxx.xxx.xxx ICMP TTL:255 TOS:0x0 ID:19804 IpLen:20 DgmLen:36 DF Type:0 Code:0 ID:32081 Seq:0 ECHO REPLY Thanks, Michael --------------------------------- Do you Yahoo!? Yahoo! Mail is new and improved - Check it out!
Current thread:
- Stopping ECHO & ECHO REPLY Alerts Michael Pace (Aug 16)
- Re: Stopping ECHO & ECHO REPLY Alerts Martin Roesch (Aug 16)