[Snort-users] ICMP from many hosts.
avleen at ...396...
Thu Oct 12 08:29:33 EDT 2000
Robert Buckley wrote:
> I was hit by an ICMP by many hosts last night, I would guess there were
> at least 15-20.
> Did anyone have the same experience? It looked like some type of
> coordinated icmp attack, but I block most ICMP and the attempt was
> stopped as the message was UNREACH. All hosts hit me at 10:34 EST.
> Something else curious too was that there was
> a private address inlcuded in that - > 10.10.232.1 ?????
> Any comments?
Looks like someone may have been trying to DDoS you.
A common pointer is addresses from a private address range.
You should block all of these at your border router.
More information about the Snort-users