[Snort-devel] Not IPv4 datagram warnings

Christopher J. Oliver cjo at ...37...
Wed Oct 9 09:11:08 EDT 2002

Re all,

I have a box snorting raw pppoe with a newly upgrade 1.9.0 snort binary rpm 
(from snort.org), and I'm getting daily IPv4 datagram warnings like the 

[**] [116:1:1] (snort_decoder) WARNING: Not IPv4 datagram! [**]
10/08-21:38:07.068312 -> IP TTL:0 TOS:0x1 ID:1540 
IpLen:0 DgmLen:2048

The IP's seem to stay the same, no matter what time of the day, and I'm 
seeing about 20 of these or thereabouts per day.

Could someone shed some light or advice and how to track down what's really 
going on?

Thanks in advance.


More information about the Snort-devel mailing list