Snort mailing list archives
Re: Alerts
From: "Bill Parker" <dogbert () netnevada net>
Date: Wed, 26 Jan 2005 10:37:37 -0800
----- Original Message ----- From: "Hugo Chun Hin Lai" <hchlai () netscape net> To: "David Young" <korang () gmail com>; <snort-users () lists sourceforge net> Sent: Wednesday, January 26, 2005 8:22 AM Subject: RE: [Snort-users] Alerts
David, I have also seen a lot of these ICMP packets on my network. In
fact, I have also seen "ICMP Destination Unreachable Communication Administratively Prohibited" alerts on my network as well. Sig 485 and sig 486 seems to be related, but I have not figured out the exact differences. I have read RFC 1812 but I am still very lost. I am currently checking my routers' ACL and firewall rules to see if I am denying any traffic that's particular causing the alert. The only worry that I have is spoofed traffic. Can anybody give me some pointers on how to investigate these alerts (ICPM Destination Unreachable Communication Administratively Prohibited & ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited)? Actually, the first step you probably want to do is to prevent your router from issuing messages about 'ip unreachables', and if you are using a cisco based router, you can apply the command 'no ip unreachables' to every interface that you have inbound from the internet and the interface which actually serves as the gateway for your LAN. Another thing which would help would be to turn off 'directed broadcasts' in the router as well (leads to a potential Smurf attack), this is also done on the router interfaces in question. Other routers may have these features as well, so I would check with the vendors also. Make sure that you back up your existing router configuration BEFORE attempting any of these things (either via TFTP) or a copy and paste operation into notepad, vi, etc. If you are in a cisco environment, a couple of good books to get are: The Cisco Cookbook - O'Reilly (ISBN 0596003676) and Hardening Cisco Routers - O'Reilly (ISBN 0596001665) Bill ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Alerts David Young (Jan 25)
- RE: Alerts Brian Jameson (Jan 26)
- <Possible follow-ups>
- RE: Alerts Hugo Chun Hin Lai (Jan 26)
- Re: Alerts Bill Parker (Jan 26)
- Alerts Brian Stamper (Feb 03)
- RE: Alerts Schott, Erik J Mr ANOSC/FCBS (Feb 03)