Snort mailing list archives
Unknown Datagram decoding problem!
From: <CGhercoias () TWEC COM>
Date: Wed, 8 Oct 2003 12:55:33 -0400
Hello, Starting last night my snort system have started to record these alerts. 177.1.0.x is our proxy-gateway and from this machine all these alerts are going all over the place in the network. Someone have seen these before? Is some kind of new exploit out there? ------------------------------------------------------------------------ ------ #(3 - 708725) [2003-10-08 10:09:50] [snort/108] (snort_decoder) Unknown Datagram decoding problem! IPv4: 177.1.0.x -> 177.1.0.y hlen=5 TOS=0 dlen=32 ID=49536 flags=0 offset=0 TTL=128 chksum=5961 ICMP: type=Redirect code=1 checksum=191 id= seq= Payload: length = 8 000 : B1 01 00 3E 45 00 04 00 ...>E... ------------------------------------------------------------------------ ------ #(3 - 708578) [2003-10-08 09:51:07] [snort/108] (snort_decoder) Unknown Datagram decoding problem! IPv4: 177.1.0.x -> 177.1.0.y hlen=5 TOS=0 dlen=33 ID=22713 flags=0 offset=0 TTL=128 chksum=32760 ICMP: type=Redirect code=1 checksum=36372 id= seq= Payload: length = 9 000 : B1 01 01 E8 45 00 05 00 70 ....E...p ------------------------------------------------------------------------ ------ #(3 - 708577) [2003-10-08 09:51:07] [snort/108] (snort_decoder) Unknown Datagram decoding problem! IPv4: 177.1.0.x -> 177.1.0.y hlen=5 TOS=0 dlen=33 ID=22489 flags=0 offset=0 TTL=128 chksum=32984 ICMP: type=Redirect code=1 checksum=36372 id= seq= Payload: length = 9 000 : B1 01 01 E8 45 00 05 00 70 ....E...p Thank you in advance, *-----------------------------------* | Catalin Ghercoias | | cghercoias () twec com *------------------------------------------* | http://www.fye.com | "Tart words make no friends; a spoonful | | | of honey will catch more flies than | | 518-452-1242 | a gallon of vinegar." | *--------------------------------| -- B. Franklin | | | *------------------------------------------* ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Unknown Datagram decoding problem! CGhercoias (Oct 08)