[Snort-users] icmp subnet mask request

Pinaud Bruno bpinaud at ...12...
Tue Jul 18 02:51:50 EDT 2000


Hi,

I've got a lots of ICMP subnet mask request (IDS216) on my network. snort is still running on a test network and there is only 4-5 nt boxes and 1 or 2  linux boxes. all the computers are on a network switch to communicate with servers and the rest of the network. 
i don't understand because the source ip is 0.0.0.0 and the dest ip is 255.255.255.255 (a broadcast,  i think it is normal) ?
Is it normal ?

Cheers PINAUD Bruno
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20000718/fa6a90ae/attachment.html>


More information about the Snort-users mailing list