Sudden surge of MISC IP Reserved bit set

[Tom Sevy <tsevy () epx com>]

This morning, for an unknown reason(s), I am seeing a deluge of MISC IP
Reserved bit setup.

Starting at 9:18, until 9:38 (about 20 minutes) I saw 53,152 of these show
up.  77 Sources, 43 destinations.

Any idea what would cause this?  We run a mix of MS & *nix systems.

Here's a sample (minus payload):

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~

#(2 - 74518) [2001-08-10 09:30:49]  MISC IP Reserved bit set
IPv14: 192.168.12.249 -> 192.168.10.10
      hlen=7 TOS=0 dlen=204 ID=32769 flags=0 offset=0 TTL=55 chksum=194
Payload:  length = 164


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users