Re: Embedded Fragment?

[Glenn Forbes Fleming Larratt <glratt () is rice edu>]

On Tue, 19 Feb 2002, Daniel Holden wrote:

> Can someone tell me (or point me to the docs) what the following means?
>
> Feb 19 21:52:52 crow kernel: ipt_unclean: (embedded packet) Embedded
> fragment.
> Feb 19 21:52:51 crow kernel: IN=eth0 OUT= MAC=uglyMacAddressHere
> SRC=192.5.4.146 DST=209.142.39.160 LEN=56 TOS=0x00 PREC=0x00 TTL=245
> ID=22342 DF PROTO=ICMP TYPE=3 CODE=13 [SRC=209.142.39.160 DST=204.152.187.2
> LEN=64 TOS=0x00 PREC=0x00 TTL=55 ID=47316 FRAG:64 PROTO=TCP ]

        It's opaque to me whether your system "crow" is generating,
        recording, or dropping the packet in question, but:

- The packet itself is an ICMP 3/13 packet, meaning type 3, code 13
(see http://www.iana.org/assignments/icmp-parameters); type 3 is
"destination unreachable", code 13 is "Communication Administratively
Prohibited", i.e. an ACL, probably on host 192.5.4.146, dropped a packet
from host 209.142.39.160.

- A truncated portion of the packet that was dropped is included *within*
the ICMP packet; enough to discern that it was a 64-byte fragment of a TCP
packet, from host 209.142.39.160 to host 204.152.187.2 .

- What's it all mean? A 64-byte fragment either implies a final fragment
or an extraordinarily short-MTU segment in the path - or crafted fragmentation
for some probably unfriendly purpose. Need more data (like a hex dump - from
Snort ;) .

        -g


> Thank you
> Daniel Holden
> dholden () idsb net
> http://www.idsb.net
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Glenn Forbes Fleming Larratt          glratt () rice edu
http://is.rice.edu/~glratt

There are imaginary bugs to chase in heaven.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users