[Snort-sigs] About the ICMP reply

trains trains at ...2395...
Mon Jan 7 15:40:22 EST 2008

Quoting Sun <snortmaillist at ...2420...>:

>    For example, 'ICMP Timestamp Request' are from external to home, but
> the 'ICMP Timestamp Reply' is still from external to home, then how can
> we detect the reply from the home server?

If you believe that some outsider sending an ICMP Timestamp request is  
an alertable event (because somebody is probing your network) the  
first rule will alert you.  If one of your inside machines *replies*  
to the Timestamp request that should perhaps also be an alertable  
event (because it means your firewall is misconfigured).  The default  
icmp.rules has no rule for the "my firewall is misconfigured" finding.  
  Perhaps it should.  Nice catch.

>    Furthermore, 'ICMP Address Mask Reply' are from home to external,

That is to alert you that your firewall is misconfigured or the server  
network options are misconfigured.  Not a security finding as much as  
a "heads-up" alert.

> but 'ICMP Address Mask Reply undefined code' are from external to home,

To alert you to the fact that a server somewhere on your network is  
sending out ICMP traffic that is totally bogus.  That's a far more  
scary thing than any of the others you've mentioned.

>    Consider the task of snort is to protect the user in home net, I

Wow, that is a messy subject:
   eight years ago, the "task of snort" was to alert us to hackers  
trying to break into our DNS servers and Mail servers (and send "shun"  
commands to the firewall very quickly).
   four years ago, the "task of snort" was to alert us to buffer  
overruns, brute force attacks, and anomalous network traffic wether  
sourced from inside or outside.
   today, I would say that one of the most important "tasks of snort"  
is to alert on internal malware infections, spyware infections, and  
internal bots gone berzerk.

>    Can any body tell me whether my above oponion is correct or not?

All opinions are (by definition) *correct* including this one.


Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact:    services at ...2395...

More information about the Snort-sigs mailing list