Snort mailing list archives
RE: Strange PATH MTU Traffic
From: larosa_vjay () emc com
Date: Tue, 26 Apr 2005 21:19:20 -0400
I could be way off here but this is the link I was referring to. http://support.microsoft.com/?id=227260 vjl -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Joshua Berry Sent: Monday, April 25, 2005 11:57 AM To: snort-users () lists sourceforge net Subject: [Snort-users] Strange PATH MTU Traffic I am getting this alert: ICMP PATH MTU denial of service I have never had this alert previous to this weekend, and have received 40,000 within the last 8 hours. Some of this traffic appears to be encrypted, the rest of it is hitting our domain controllers and contains schema information. I know Microsoft does some screwy stuff but I have never seen schema information transmitted in an ICMP packet, much less a path mtu discovery packet. Anyone else seen this type of traffic? Josh Berry | CISSP GCIA Information Security 214-765-1296 -------------------------------------------------------------------- If you spend more on coffee than on IT security, you will be hacked. What's more, you deserve to be hacked. -- (Former) White House Cybersecurity adviser Richard Clarke ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_ide95&alloc_id396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- SF.Net email is sponsored by: Tell us your software development plans! Take this survey and enter to win a one-year sub to SourceForge.net Plus IDC's 2005 look-ahead and a copy of this survey Click here to start! http://www.idcswdc.com/cgi-bin/survey?id=105hix _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Strange PATH MTU Traffic Joshua Berry (Apr 26)
- <Possible follow-ups>
- RE: Strange PATH MTU Traffic larosa_vjay (Apr 26)
- RE: Strange PATH MTU Traffic larosa_vjay (Apr 26)