RE: how to further diagnose 'ICMP Destination Unreachable' problem?

["Briggs, Bruce" <Bruce.Briggs () suny edu>]

You can find out a little more about ICMP Destination Unreachable here:
http://www.networksorcery.com/enp/protocol/icmp/msg3.htm 

It could be caused by a number of things. For example there could be a
firewall (or router with ACLs) which is preventing a packet from being
received/forwarded and if the firewall had an option enabled to notify
the sender of this blocked port packet, then an ICMP type 3 code 3
packet would be sent out to the initiating IP addr from the firewall.

Bruce

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Chris W.
Parker
Sent: Monday, August 29, 2005 1:12 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] how to further diagnose 'ICMP Destination
Unreachable' problem?

Hello,

I have a lot of 'ICMP Destination Unreachable Port Unreachable' alerts
(36%) and I'm wondering what I should do to diagnose and correct the
problem.

I don't know much about networking so I wasn't able to glean much
insight from the Snort website
(http://www.snort.org/pub-bin/sigs.cgi?sid=402).

Any suggestions?


Thanks,
Chris.


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle
Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing &
QA
Security * Process Improvement & Measurement *
http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users