Snort mailing list archives

Stopping ECHO & ECHO REPLY Alerts


From: Michael Pace <mpace79 () yahoo com>
Date: Wed, 11 Aug 2004 06:24:45 -0700 (PDT)

I am currently seeing hundreds of the alerts below, but I'm not sure what rule is causing them.  I don't really care to 
have an email sent to me every time someone does a basic echo request on my firewall.  I'd like to change the rule to 
log instead of alert.  Can anyone tell me where to look?
 
[Classification: Misc activity] [Priority: 3] 
08/11-07:29:02.490037 63.163.102.37 -> xxx.xxx.xxx.xxx
ICMP TTL:49 TOS:0x0 ID:27096 IpLen:20 DgmLen:64
Type:8  Code:0  ID:28958   Seq:512  ECHO

[Classification: Misc activity] [Priority: 3] 
08/11-07:29:49.362139 216.15.147.20 -> xxx.xxx.xxx.xxx
ICMP TTL:255 TOS:0x0 ID:19804 IpLen:20 DgmLen:36 DF
Type:0  Code:0  ID:32081  Seq:0  ECHO REPLY
 
 
Thanks,
 
Michael

                
---------------------------------
Do you Yahoo!?
Yahoo! Mail is new and improved - Check it out!

Current thread: