Re: Re:A new type of ICMP packet

[Chris Green <cmg () uab edu>]

Matt Scarborough <vexversa () usa net> writes:

> On Fri, 25 May 2001 10:11:30 -0600, Phil Wood  wrote:
>
> > Eight unknown ICMP's left my establishment last night at 1 second intervals.
>
> ICMP payload 3f3f 3f3f with TTL 10 indicate Napster. But ICMP code and type
> 0254 do not.
>
> Then again, if that is ICMP Id 666 (029a) other things may be afoot.

Check to see  if your src addy is a macintosh running napster.  There
seems to be a napster client for macs that has that icmpid ( check the
archives for futher info )
-- 
Chris Green <cmg () uab edu>
Fame may be fleeting but obscurity is forever.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users