Snort mailing list archives
non-standard-protocol : BAD-TRAFFIC IP Proto 103 PIM
From: David Ryan <David.Ryan () Quintiles com>
Date: Thu, 17 May 2007 07:21:56 -0400
Hi all, I am seeing loads (like 90% of all events) of these events showing up on one of my Snort sensors. I have looked at the description here - http://www.snort.org/pub-bin/sigs.cgi?sid=2189 - and I looked at the rule definition and it appears to match simply on the existence of IP protocol 103 as distinct from any payload within it. I see the traffic coming from two known Cisco routers on the subnet I'm monitoring and the traffic is destined for 224.0.0.13 which is the multicast address for PIM - http://www.networksorcery.com/enp/protocol/pim.htm I have also I have seen it on other sites and subnets on the network I am monitoring, so I guess whatever function is causing this traffic to originate from the router is used across the organisation. In order to make the output from snort a little more readable (and because it is matching on the protocol and not the payload) I have disabled this rule. I know the protocol in question is a routing-related protocol, but does anyone have any views or explanation on the normal use of this protocol ? Thanks, David =========================================== David Ryan IT Security Engineer, Global IT Security Quintiles, Global IT - Infrastructure, QDUB david.ryan () quintiles com v: +353-1-819-5186, GMT+0 m: +353-87-124-9108 =========================================== ********************** IMPORTANT--PLEASE READ ************************ This electronic message, including its attachments, is COMPANY CONFIDENTIAL and may contain PROPRIETARY or LEGALLY PRIVILEGED information. If you are not the intended recipient, you are hereby notified that any use, disclosure, copying, or distribution of this message or any of the information included in it is unauthorized and strictly prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and permanently delete this message and its attachments, along with any copies thereof. If this electronic message contains a zipped attachment and you do not have a decompression tool, you may download unZIP (free of cost) from: http://www.mk-net-work.com/us/uz/unzip.htm. Alternatively, you may request that the attachment be resent in an uncompressed format. Thank you. ************************************************************************
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- non-standard-protocol : BAD-TRAFFIC IP Proto 103 PIM David Ryan (May 17)
- Re: non-standard-protocol : BAD-TRAFFIC IP Proto 103 PIM doug schmidt (May 17)
- Re: non-standard-protocol : BAD-TRAFFIC IP Proto 103 PIM doug schmidt (May 17)
- <Possible follow-ups>
- Re: non-standard-protocol : BAD-TRAFFIC IP Proto 103 PIM David Ryan (May 17)
- Re: non-standard-protocol : BAD-TRAFFIC IP Proto 103 PIM Gregory S Thomas (May 17)
- Re: non-standard-protocol : BAD-TRAFFIC IP Proto 103 PIM doug schmidt (May 17)