What is snort doing to the packets

["Bagwell, Steve" <sbagwell () above net>]

We have been getting alot of ICMP PING CyberKit 2.2 Windows alerts. The
reason behind the alert is easy enough but the Src IP and Dest IP are
confusing. The alerts scroll across the screen most of the night but are not
worth investigating because neither the Src IP or Dest IP are ever
reachable. I started capturing packets to see what was going on and all the
packets which would trigger this type of alert have legitimate Src IP and
Dest IP. What could be happening after snort runs them through the rules? 

One theory is : 

        The Src IP is broadcasting it's internal IP space. 

Alert from E-Sentinel:

 Event - snort: [ID 702911 local5.alert] [1:483:2] ICMP PING CyberKit 2.2
Windows
 [Classification: Misc activity] [Priority: 3]: {ICMP} 192.168.100.107 ->
64.124.244.87 -


Thanks

Steve


-------------------------------------------------------
This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo
The Event For Linux Datacenter Solutions & Strategies in The Enterprise 
Linux in the Boardroom; in the Front Office; & in the Server Room 
http://www.enterpriselinuxforum.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users