Snort mailing list archives
Re: ICMP Packets.
From: Jim Burwell <jimb () broadvision com>
Date: Mon, 26 Aug 2002 19:10:33 -0700
Heh. Interesting. This was in ICMP ? It looks like a JPEG image header if I'm not mistaken.
- Jim larosa, vjay wrote:
Anybody recognize this payload? It is part of an ICMP packet. I havesearched google and haven't found any reason why I would see this data in an ICMP echo packet. Awfull suspicous....vjl FF D8 FF FE 00 08 57 41 4E 47 32 02 FF E0 00 10 ......WANG2..... 4A 46 49 46 00 01 01 01 00 60 00 60 00 00 FF DB JFIF.....`.`.... 00 43 00 10 0B 0C 0E 0C 0A 10 0E 0D 0E 12 11 10 .C............. 13 18 28 1A 18 16 16 18 31 23 25 1D 28 3A 33 3D ..(.....1#%.(:3= 3C 39 33 38 37 40 48 5C 4E 40 44 57 45 37 38 50 <9387@H\N@DWE78P 6D 51 57 5F 62 67 68 67 3E 4D 71 79 70 64 78 5C mQW_bghg>Mqypdx\ 65 67 63 FF DB 00 43 01 11 12 12 18 15 18 2F 1A egc...C......./. 1A 2F 63 42 38 42 63 63 63 63 63 63 63 63 63 63 ./cB8Bcccccccccc 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 cccccccccccccccc 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 cccccccccccccccc 63 63 63 63 63 63 63 63 FF C0 00 11 08 00 26 00 cccccccc......&. 9E 03 01 21 00 02 11 01 03 11 01 FF C4 00 1F 00 ...!............ 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 ................ 00 01 02 03 04 05 06 07 08 09 0A 0B FF C4 00 B5 ................ 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 ................ 7D 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 }........!1A..Qa 07 22 71 14 32 81 91 A1 08 23 42 B1 C1 15 52 D1 ."q.2....#B...R. F0 24 33 62 72 82 09 0A 16 17 18 19 1A 25 26 27 .$3br........%&' 28 29 2A 34 35 36 37 38 39 3A 43 44 45 46 47 48 ()*456789:CDEFGH 49 4A 53 54 55 56 57 58 59 5A 63 64 65 66 67 68 IJSTUVWXYZcdefgh 69 6A 73 74 75 76 77 78 79 7A 83 84 85 86 87 88 ijstuvwxyz...... 89 8A 92 93 94 95 96 97 98 99 9A A2 A3 A4 A5 A6 ................ A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4 ................ C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E1 ................ E2 E3 E4 E5 E6 E7 E8 E9 EA F1 F2 F3 F4 F5 F6 F7 ................ F8 F9 FA FF C4 00 1F 01 00 03 01 01 01 01 01 01 ................ 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 ................ 08 09 0A 0B FF C4 00 B5 11 00 02 01 02 04 04 03 ................ 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 ........w....... 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 !1..AQ.aq."2...B 91 A1 B1 C1 09 23 33 52 F0 15 62 72 D1 0A 16 24 .....#3R..br...$ 34 E1 25 F1 17 18 19 1A 26 27 28 29 2A 35 36 37 4.%.....&'()*567 38 39 3A 43 44 45 46 47 48 49 4A 53 54 55 56 57 89:CDEFGHIJSTUVW 58 59 5A 63 64 65 66 67 68 69 6A 73 74 75 76 77 XYZcdefghijstuvw 78 79 7A 82 83 84 85 86 87 88 89 8A 92 93 94 95 xyz............. 96 97 98 99 9A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3 ................ B4 B5 B6 B7 B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA ................ D2 D3 D4 D5 D6 D7 D8 D9 DA E2 E3 E4 E5 E6 E7 E8 ................ E9 EA F2 F3 F4 F5 F6 F7 F8 F9 FA FF DA 00 0C 03 ................ 01 00 02 11 03 11 00 3F 00 ED 35 6D 4A 1D 23 4D .......?..5mJ.#M 96 FA E1 64 68 A2 C6 E1 18 05 B9 20 71 92 3D 6A ...dh...... q.=j AE 81 E2 2B 2F 10 47 33 59 89 50 C2 40 74 95 40 ...+/.G3Y.P.@t.@ 23 3D 0F 04 8E C7 BF 6A 00 D6 AE 75 FC 67 A6 2E #=.....j...u.g.. B6 34 A5 8E E5 E6 F3 C4 1B D5 06 CD E4 E3 B9 CF .4.............. 07 8E 9D BB D0 06 86 A7 AD DB 69 77 B6 16 B3 A4 ..........iw.... AC F7 D2 79 71 94 00 80 72 A3 9C 91 FD E1 EB 5A ...yq...r......Z 54 00 51 40 05 14 00 51 40 05 14 00 51 40 0D 92 T.Q@...Q@...Q@. 44 8A 36 92 47 54 44 05 99 98 E0 28 1D 49 35 CC D.6.GTD....(.I5. DB F8 F3 49 B9 D4 62 B3 86 2B B6 69 65 11 24 9B ...I..b..+.ie.$. 14 29 24 E0 1E 5B 38 FC 33 ED 40 1B D6 BA 8D A5 .)$..[8.3.@..... E5 D5 CD B5 B4 EB 24 B6 A4 2C CA A0 FC 84 E7 8C ......$..,...... F4 3D 0F 4E 98 AB 54 01 CF F8 EF FE 45 0B EF FB .=.N..T.....E... 67 FF 00 A3 16 B9 9F 0C 11 A1 F8 A2 C6 1D CA 96 g............... FA A5 84 4E 07 98 40 0E 50 1C 90 7A 92 CA C0 0F ...N..@.P..z.... F6 F8 F4 A0 0E F3 53 BD 4D 37 4D B9 BD 93 69 10 ......S.M7M...i. 46 5F 6B 36 DD C4 0E 17 3E E7 03 F1 AF 2D D3 AC F_k6....>....-.. DA 39 FC 3B A8 4C DB E7 BE D4 19 DA 42 C4 B3 05 .9.;.L......B... 78 C7 39 EF BB 79 FC 68 03 D1 35 AD 77 FB 27 51 x.9..y.h..5.w.'Q D2 ED 3E CD E6 FD BE 5F 2F 76 FD BB 39 51 9C 60 ..>...._/v..9Q.` E7 EF 7B 74 AB 5A BE AF 69 A2 D9 7D AA F5 D9 50 ..{t.Z..i..}...P 9D AA 15 49 2C D8 24 01 F5 C1 EB 81 40 1C EF FC ...I,.$.....@... 27 13 47 FE 91 71 A0 5F 47 A7 9E 45 CE 0F 2A 7E '.G..q._G..E..*~ E9 C1 00 73 91 FC 5D FB D7 45 2E A9 07 F6 24 BA ...s..]..E....$. A5 AB 2D C4 29 03 4C BB 4E 37 6D 04 E3 DB A6 3D ..-.).L.N7m....= A8 03 9D B6 F1 C4 D7 E9 00 D3 74 49 EE E7 6F F5 ..........tI..o. C8 8E 76 C2 4B 10 A0 B6 DC 72 06 72 70 07 AF 5C ..v.K....r.rp..\ 6D 78 83 C4 16 9A 05 A8 92 E7 73 CB 20 6F 26 25 mx........s. o&% 07 F7 84 63 BF 41 D4 75 FD 7A 50 06 2A F8 DE E2 ...c.A.u.zP.*... DE 68 8E AB A0 DD D8 5A BB EC 69 DF 71 0A 4F B1 .h.....Z..i.q.O. 51 9F E7 8C F5 AE 99 F5 1B 48 F4 D1 A8 C9 3A A5 Q........H....:. A1 8C 4B E6 30 23 E5 23 23 8E BC E4 71 D6 80 39 ..K.0#.##...q..9 9F F8 4D 6F 2E 3F 7B A7 F8 6E FA E6 D5 BE E4 BC ..Mo.?{..n...... 8D DE BD 14 8E B9 1D 7B 56 C7 87 3C 45 6B E2 1B .......{V..<Ek.. 79 1E DD 24 8A 58 76 89 63 71 F7 49 1D 8F 71 C1 y..$.Xv.cq.I..q. F4 3C 74 14 01 1F 88 7C 4D 6F A2 32 5B AC 32 5D .<t....|Mo.2[.2] 5F 4B B7 CB B6 40 41 60 49 19 CE 0F A1 18 19 39 _K...@A`I......9 C7 1D EB 36 0F 1C 18 6E 92 3D 6B 49 B9 D2 E2 90 ...6...n.=kI.... 1D B2 C8 19 B2 47 B6 D0 7F 2C F5 1F 5A 00 B9 E3 .....G..?,..Z... 4D 4A E6 CB 4A 92 08 34 E9 6E 92 E6 09 52 49 53 MJ..J..4.n...RIS 38 80 6D C6 E3 80 7D 49 ED D2 B9 BF 0C 78 82 FF 8.m...}I.....x.. 00 4D D0 E1 B7 B4 F0 DD CD D2 65 98 DC 44 18 09 .M........e..D.. 09 63 CF 08 73 8E 07 5E D4 01 5F C3 FA F5 FD 96 .c..s..^.._..... AB AC 4F 06 87 73 74 F7 33 EF 92 24 DD 98 0E E7 ..O..st.3..$.... 3B 4E 14 FA 91 DB A5 7A 75 00 73 FE 3B FF 00 91 ;N.....zu.s.;... 42 FB FE D9 FF 00 E8 C5 AC 1F 11 DB 4A BE 0E D0 B...........J... 75 5B 62 C2 6B 08 E1 60 DC 61 41 55 E7 07 AF CC u[b.k..`.aAU.... 13 F3 34 01 6B C6 FA 93 5F 68 7A 65 A5 92 C9 BF ..4.k..._hze.... 56 74 64 56 0A 32 BC 10 A4 93 C1 DC C9 F9 1E 7D VtdV.2.........} 5B E2 8B 64 B3 D5 7C 23 6B 19 62 90 4E 23 52 DD [..d..|#k.b.N#R. 48 0D 10 19 FC A8 02 6F 1A 7F C8 C3 E1 8F FA FB H.....o.?...... FF 00 D9 E3 A8 FC 45 0A EA 3E 3F D1 B4 FB 93 BA ......E..>?..... D5 62 33 79 78 18 27 E6 27 39 1C 83 B1 41 1E 94 .b3yx.'.'9...A.. 01 D8 5C 41 1D CD BC B6 F3 2E E8 A5 42 8E B9 C6 ..\A........B... 41 18 23 8A C3 97 48 87 44 F0 7E A7 67 6F 34 F2 A.#...H.D.~.go4. C5 F6 79 99 7C E6 0C 57 28 78 18 03 03 BF D4 9A ..y.|..W(x...... 00 6F 80 63 44 F0 95 9B 22 2A 97 32 33 10 31 B8 .o.cD..."*.23.1. EF 61 93 EB C0 03 F0 AC D4 85 75 1F 8A 17 02 E8 .a........u..... EF 5B 1B 75 78 54 81 80 70 B8 CF 1C E0 BB 1F 5C .[.uxT..p......\ E3 D2 80 3A CB FB 28 75 1B 19 EC EE 17 31 4C 85 ...:..(u.....1L. 5B 81 91 EE 33 DC 75 1E E2 B8 9F 0C 59 CF AE FC [...3.u.....Y... 3E BC D3 44 CA 84 4E 52 22 CB C2 E0 AB E0 E3 D4 >..D..NR"....... 93 CF 3D 7D B1 40 10 DB F8 9B 5F F0 CD BC 56 9A ..=}.@...._...V. B6 93 BE DE 04 11 24 9C A6 4E 32 A3 78 CA 9C 0E ......$..N2.x... 30 06 78 F6 35 B9 E1 AD 43 C3 DA A6 AF 73 77 A6 0.x.5...C....sw. DB C9 06 A1 22 13 28 75 20 B2 E5 72 D8 04 AF 27 ....".(u ..r...' 1E F9 CD 00 53 F0 BC 2B 7B E3 3D 7A FE E4 EF 9E ....S..+{.=z.... DA 5F 26 32 40 C2 8C B2 FA 75 0A 80 67 D0 9E B9 ._&2@....u..g... AD CF 16 D9 43 7B E1 AB E5 99 73 E5 44 D3 21 00 ....C{....s.D.!. 65 59 41 23 19 E9 D3 1F 42 68 03 2F 4B 9E 4B 8F eYA#....Bh./K.K. 86 4E F2 B6 E6 16 53 A0 38 C7 0A 19 40 FC 80 AB .N....S.8...@... 9E 04 FF 00 91 42 C7 FE DA 7F E8 C6 A0 0C FF 00 .....B...?...... 05 FF 00 C8 C3 E2 7F FA FB FF 00 D9 E4 AE C2 80 ......?......... 39 FF 00 1D FF 00 C8 A1 7D FF 00 6C FF 00 F4 62 9.......}..l...b D4 D6 56 49 A9 78 2E D6 CA 4D A0 4F 61 1A 6E 65 ..VI.x...M.Oa.ne DD B4 94 18 6C 7B 1C 1F C2 80 38 DF 05 C1 36 A1 ....l{....8...6. AD D9 43 71 14 89 16 8F 13 EE 49 14 95 F3 0B B1 ..Cq......I..... E4 1F BA DF 37 D7 F7 7F 96 E7 8D 3F E4 61 F0 C7 ....7..?...?.a.. FD 7D FF 00 EC F1 D0 01 E3 4F F9 18 7C 31 FF 00 .}.......O..|1.. 5F 7F FB 3C 75 37 8C 2C 2F 62 BA B2 D7 74 88 5A _?.<u7.,/b...t.Z 5B DB 43 B1 91 50 BE F4 39 ED 9E D9 23 81 9F 9B [.C..P..9...#... 39 18 A0 0A BF F0 B0 61 BA B7 F2 B4 FD 36 EE 5D 9......a.....6.] 41 D3 E4 8B 68 65 DD 8E 7A 1C 90 39 3D 06 71 DB A...he..z..9=.q. B5 E8 6C 6F 6C 3C 0B 7F 1E A5 71 2C F7 6F 6D 33 ..lol<.?..q,.om3 C8 64 94 C9 B3 28 70 A0 FB 00 3D 79 CD 00 4D E0 .d...(p...=y..M. 4F F9 14 2C 7F ED A7 FE 8C 6A CD F1 35 9D EE 91 O..,?....j..5... AF 47 E2 4D 36 06 99 16 32 2F 23 0C 46 54 60 64 .G.M6...2/#.FT`d F3 9E 98 E8 30 36 64 D0 04 77 7E 35 3A BD AC 96 ....06d..w~5:... 3E 1F B1 BC 92 F6 61 B0 33 28 5F 2D 4F 05 B2 AC >.....a.3(_-O... V.Jay LaRosa EMC Corporation Information Security 171 South Street (508)249-3355 office Hopkinton, MA 01748 (508)498-5575 cell www.emc.com (888-799-9750 pager larosa_vjay () emc com (508)497-8082 fax ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ICMP Packets. larosa, vjay (Aug 26)
- Re: ICMP Packets. Skip Carter (Aug 26)
- Re: ICMP Packets. Jim Burwell (Aug 26)
- <Possible follow-ups>
- RE: ICMP Packets. larosa, vjay (Aug 26)
- Re: ICMP Packets. Jason Haar (Aug 26)
- RE: ICMP Packets. Rich Adamson (Aug 27)
- RE: ICMP Packets. larosa, vjay (Aug 27)
- RE: ICMP Packets. larosa, vjay (Aug 27)
- Re: ICMP Packets. Vinay A. Mahadik (Aug 27)
- Re: ICMP Packets. Matt Kettler (Aug 29)
- Re: ICMP Packets. Vinay A. Mahadik (Aug 27)
- RE: ICMP Packets. larosa, vjay (Aug 29)