[Snort-users] icmp subnet mask request

Martin Roesch roesch at ...1...
Wed Jul 19 02:42:23 EDT 2000


Doesn't sound particularly normal to me....

    -Marty

> Pinaud Bruno wrote:
> 
> Hi,
> 
> I've got a lots of ICMP subnet mask request (IDS216) on my network. snort is
> still running on a test network and there is only 4-5 nt boxes and 1 or 2
>  linux boxes. all the computers are on a network switch to communicate with
> servers and the rest of the network.
> i don't understand because the source ip is 0.0.0.0 and the dest ip is
> 255.255.255.255 (a broadcast,  i think it is normal) ?
> Is it normal ?
> 
> Cheers PINAUD Bruno

-- 
Martin Roesch                      <roesch at ...2...>
Core R&D                         http://www.hiverworld.com
Hiverworld, Inc.       Continuous Adaptive Risk Management




More information about the Snort-users mailing list