Re: ICMP Source Quench

[Chris Green <cmg () sourcefire com>]

"Bryan Waters" <bryanw () abwaters com> writes:

> What is an "ICMP Source Quench"?
>
> I have snort running and its working fine...i'm just looking for a place to
> determine what some of the more poorly documented rules are...so i can get
> an idea of what exactly is happening and how much of a threat it is...

Please tell me you atleast did (Lie if you have to :-)):

http://www.google.com/search?hl=en&query=ICMP+Source+Quench.

http://www.firewall.cx/icmp-source-quench.php

The additional $0.02 from experience:

Often times if you see ICMP source quenches your network is either
flooding a particular network OR you netblock is being spoofed and
some poor old sod is being flooded and can only yell at you about it.

Try reverse dns on the Source IP and if it's an IRC server, it's probably
the latter.
-- 
Chris Green <cmg () sourcefire com>
Fame may be fleeting but obscurity is forever.


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users