Re: external net

[Pontus Joakimsson <jpontus () ess nec de>]

Hi,

  What I did was to create a local rule for that one:

  pass icmp $HOME_NET any -> $HOME_NET any (msg:"ICMP redirect net";itype:5; \
  icode:0; reference:arachnids,199; reference:cve,CVE-1999-0265; classtype:bad-unknown; \
  sid:473; rev:1;)

Regards,
  Pontus Joakimsson


On Friday 10 August 2001 17:20, Birkir Björnsson wrote:
> I´ve my snort.conf  set with homenet  specified for three /24 nets, the
> external net is set to any.
> And i´m getting these kind things in my log.
>
> [**] [1:473:1] ICMP redirect net [**]
> [Classification: Potentially Bad Traffic] [Priority: 2]
> 08/10-15:17:10.455654 193.4.194.1 -> 193.4.194.25
> ICMP TTL:30 TOS:0x0 ID:12657 IpLen:20 DgmLen:56
> Type:5  Code:0  REDIRECT
> [Xref => http://www.whitehats.com/info/IDS199]
> [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0265]
>
>
> How do i exclude my home net from the external nets.?
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users