[Snort-users] icmp subnet mask request

Martin Roesch roesch at ...1...
Wed Jul 19 02:42:23 EDT 2000

Doesn't sound particularly normal to me....


> Pinaud Bruno wrote:
> Hi,
> I've got a lots of ICMP subnet mask request (IDS216) on my network. snort is
> still running on a test network and there is only 4-5 nt boxes and 1 or 2
>  linux boxes. all the computers are on a network switch to communicate with
> servers and the rest of the network.
> i don't understand because the source ip is and the dest ip is
> (a broadcast,  i think it is normal) ?
> Is it normal ?
> Cheers PINAUD Bruno

Martin Roesch                      <roesch at ...2...>
Core R&D                         http://www.hiverworld.com
Hiverworld, Inc.       Continuous Adaptive Risk Management

More information about the Snort-users mailing list