[Snort-users] icmp subnet mask request
roesch at ...1...
Wed Jul 19 02:42:23 EDT 2000
Doesn't sound particularly normal to me....
> Pinaud Bruno wrote:
> I've got a lots of ICMP subnet mask request (IDS216) on my network. snort is
> still running on a test network and there is only 4-5 nt boxes and 1 or 2
> linux boxes. all the computers are on a network switch to communicate with
> servers and the rest of the network.
> i don't understand because the source ip is 0.0.0.0 and the dest ip is
> 255.255.255.255 (a broadcast, i think it is normal) ?
> Is it normal ?
> Cheers PINAUD Bruno
Martin Roesch <roesch at ...2...>
Core R&D http://www.hiverworld.com
Hiverworld, Inc. Continuous Adaptive Risk Management
More information about the Snort-users