RE: Snort-users digest, Vol 1 #5138 - 1 msg

["Dennis Henderson" <hendo () hendohome com>]

> Message: 1
> Date: Mon, 30 May 2005 13:40:34 -0700 (PDT)
> From: Paulo <listassec () yahoo com>
> Subject: Re: [Snort-users] Alerts of the ICMP relationship 
> with smtp connection?
> To: "Snort.org List" <snort-users () lists sourceforge net>
>
>
> I didn't solve this yet. Please, anyone can help me?
>
> Thanks again.
>
> --- Paulo <listassec () yahoo com> wrote:



HP and some other UNIX systems perform MTU path detection before they
initiate IP connections. This usually manifests itself as a ping packet of
the largest size for the transmission medium that the server is connected
to. It sets the Don't fragment flag on the packet. If the packet encounters
a router that has a lower MTU, the router cannot fragment the packet and it
will send back ICMP to the original server saying that it needed to fragment
but the Don't fragment flag was set. The server will then lower the MTU a
specified number of bytes and resend the ping. It will continue doing this
until the ping packet makes it to the target.

<SIDEBAR> This is why it is good practice to allow ICMP destination
unreacheable messages back towards your external firewalls and routers. If
they block the ICMP unreacheable messages, you might experience strange
performance issues with some Internet destinations. In fact I believe the
RFC states that you should accept these messages.
</SIDEBAR>


> The source IP address in snort's log is equal
> the
> destination IP address in the maillog to smtp connection.



This is probably the mail server sending back notification that the message
was received. Its pinging you right before it sends the delivery notice or
read receipt.


That message is an email that is really no different than the server sending
your server a normal email from someone at that domain.



Both Matt Jonkman(he contributed earlier in this thread and I am just adding
more detail) and I worked at a large telecom company that had mailservers
that did just this. Its annoying, but the ICMP packet is the way the server
perfroms MTU path discovery. 

I hope this clears it up for you

Dennis



-------------------------------------------------------
This SF.Net email is sponsored by Yahoo.
Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
Search APIs Find out how you can build Yahoo! directly into your own
Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users