Snort mailing list archives

some strange alerts


From: dawnshade <h-k () mail ru>
Date: Wed, 16 Apr 2003 09:41:41 +0400

Hello, All.

After installing snort 2.0 i see many strange alerts like this:
--------------------------------------
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]
04/16/03-04:00:17.143503 111.119.49.57 -> 46.114.111.115                       
IPX-IN-IP TTL:77 TOS:0xB4 ID:1 IpLen:8 DgmLen:35535                            
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:18.843381 255.255.55.217 -> 130.150.200.254                     
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:28.843456 255.255.55.217 -> 170.23.88.1                         
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:38.842883 255.255.55.217 -> 209.152.200.254                     
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:48.886830 255.255.55.217 -> 249.69.101.100                      
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:58.887032 255.255.55.218 -> 32.198.248.91                       
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:01:08.886991 255.255.55.218 -> 72.71.200.254                       
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:01:17.142097 111.119.49.57 -> 46.114.111.115                       
IPX-IN-IP TTL:77 TOS:0xB4 ID:1 IpLen:8 DgmLen:35535
-------------------------------------------

Any ideas about it????
  

----------
Best regards,
 dawnshade                            mailto:h-k () mail ru



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: