Snort mailing list archives
Re: Strange Snort Warning: Hello, is anybody home?
From: Erek Adams <erek () theadamsfamily net>
Date: Wed, 4 Sep 2002 15:54:20 -0700 (PDT)
On Wed, 4 Sep 2002, Sandy Biring wrote:
I saw this alert in ACID today (9 packets in total): Source Addr: 255.255.255.255 Dest Addr: 10.0.4.8 Type: (0) Echo Reply Code: (0) 0 Checksum: 1276 Payload: length = 24 000 : 48 65 6C 6C 6F 2C 20 69 73 20 61 6E 79 62 6F 64 Hello, is anybod 010 : 79 20 68 6F 6D 65 3F 00 y home?. Another alert shows the same payload, but 10.0.4.8 as the source and the destination! (it is a Win2k server) Can anyone tell me what this is, and if its anything to worry about???
Two places to look for answers to questions about snort: 1) Google ("Hello, is anybody home?" icmp) 2) Mailing list archives. So... Answers are: 1) http://www.google.com/search?client=googlet&q=%22Hello%2C%20is%20anybody%20home%3F%22%20icmp (Line wraps) 2) http://marc.theaimsgroup.com/?l=snort-users&m=101975423419431&w=2 Is it something to worry about? No idea. You need to check the machine(s) involved and give them a good going over. Cheers! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Strange Snort Warning: Hello, is anybody home? Sandy Biring (Sep 04)
- Re: Strange Snort Warning: Hello, is anybody home? Erek Adams (Sep 04)
- Re: Strange Snort Warning: Hello, is anybody home? Matt Kettler (Sep 04)