RE: Strange PATH MTU Traffic

[larosa_vjay () emc com]

I believe this has to do with Microsoft Roaming profiles. I will try to dig
up the URL. I have actually seen Jpeg's transmitted in ICMP from M$ hosts.

vjl 

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Joshua Berry
Sent: Monday, April 25, 2005 11:57 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Strange PATH MTU Traffic

I am getting this alert: ICMP PATH MTU denial of service

I have never had this alert previous to this weekend, and have received
40,000 within the last 8 hours.  Some of this traffic appears to be
encrypted, the rest of it is hitting our domain controllers and contains
schema information.

I know Microsoft does some screwy stuff but I have never seen schema
information transmitted in an ICMP packet, much less a path mtu discovery
packet.

Anyone else seen this type of traffic?
 
Josh Berry | CISSP GCIA
Information Security
214-765-1296
 
--------------------------------------------------------------------
If you spend more on coffee than on IT security, you will be hacked. 
What's more, you deserve to be hacked. 
     -- (Former) White House Cybersecurity adviser Richard Clarke 



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users