Snort mailing list archives
some strange alerts
From: dawnshade <h-k () mail ru>
Date: Wed, 16 Apr 2003 09:41:41 +0400
Hello, All. After installing snort 2.0 i see many strange alerts like this: -------------------------------------- [**] [116:1:1] <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**] 04/16/03-04:00:17.143503 111.119.49.57 -> 46.114.111.115 IPX-IN-IP TTL:77 TOS:0xB4 ID:1 IpLen:8 DgmLen:35535 [**] [116:1:1] <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**] 04/16/03-04:00:18.843381 255.255.55.217 -> 130.150.200.254 MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF [**] [116:1:1] <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**] 04/16/03-04:00:28.843456 255.255.55.217 -> 170.23.88.1 MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF [**] [116:1:1] <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**] 04/16/03-04:00:38.842883 255.255.55.217 -> 209.152.200.254 MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF [**] [116:1:1] <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**] 04/16/03-04:00:48.886830 255.255.55.217 -> 249.69.101.100 MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF [**] [116:1:1] <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**] 04/16/03-04:00:58.887032 255.255.55.218 -> 32.198.248.91 MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF [**] [116:1:1] <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**] 04/16/03-04:01:08.886991 255.255.55.218 -> 72.71.200.254 MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF [**] [116:1:1] <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**] 04/16/03-04:01:17.142097 111.119.49.57 -> 46.114.111.115 IPX-IN-IP TTL:77 TOS:0xB4 ID:1 IpLen:8 DgmLen:35535 ------------------------------------------- Any ideas about it???? ---------- Best regards, dawnshade mailto:h-k () mail ru ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- some strange alerts dawnshade (Apr 15)
- <Possible follow-ups>
- some strange alerts dawnshade (Apr 16)