RE: ICMP Source Quench

["McCammon, Keith" <Keith.McCammon () eadvancemed com>]

Hard to say for sure without seeing the traffic that preceded (or followed) the SQ message.  However, this generally 
means that 195.161.172.228 is experiencing congestion, and that 213.152.133.10 should reduce the amount of data that it 
is sending.  Most TCP implementation will respond in a manner similar to that of a TCP window size reduction.

While this can be sent in response to any protocol, SQ is generally associated with congestion control mechanisms in 
TCPs.

> -----Original Message-----
> From: Sergei Balyakin [mailto:sergei () rsl ru]
> Sent: Tuesday, August 27, 2002 9:16 AM
> To: snort-users-request () lists sourceforge net
> Subject: [Snort-users] ICMP Source Quench
>
>
> Hi!
>
> Does anyone knows what it means. Too many messages last some days.
> Thankx in advance.
>
> [**] ICMP Source Quench [**]
> 08/26-11:26:25.412038 195.161.172.228 -> 213.152.133.10
> ICMP TTL:247 TOS:0x0 ID:45317 IpLen:20 DgmLen:56
> Type:4  Code:0  SOURCE QUENCH
> 00 00 00 00 45 00 05 DC 5F C5 40 00 36 06 27 DF  ....E..._.@.6.'.
> D5 98 85 0A D9 6B 83 69 00 50 04 04 29 71 38 2C  .....k.i.P..)q8,
>
>
>
>
>
> -- 
> Best regards,
>  Sergei                            mailto:sergei () rsl ru
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by: OSDN - Tired of that same old
> cell phone?  Get a new here for FREE!
> https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users