[Snort-sigs] ICMP Echo Request

Jeffrey C. Ollie jeff at ...97...
Mon Sep 10 13:20:04 EDT 2001


On Mon, Sep 10, 2001 at 12:45:28PM -0700, Dragos Ruiu wrote:
>
> The reason why you don't see this imho is because it would false
> enough to be annoying and become irrelevant for meaningful reporting
> unless you are using it on a strictly private internal segment.

Yes, but without this rule, echo requests show up as "ICMP Unknown
Type" which would worry me more.

Jeff




More information about the Snort-sigs mailing list