[Snort-users] ICMP from many hosts.

Avleen Vig avleen at ...396...
Thu Oct 12 08:29:33 EDT 2000


Robert Buckley wrote:
> 
> I was hit by an ICMP by many hosts last night, I would guess there were
> at least 15-20.
> Did anyone have the same experience? It looked like some type of
> coordinated icmp attack, but I block most ICMP and the attempt was
> stopped as the message was UNREACH. All hosts hit me at 10:34 EST.
> Something else curious too was that there was
> a private address inlcuded in that - > 10.10.232.1  ?????
> Any comments?

Looks like someone may have been trying to DDoS you.
A common pointer is addresses from a private address range.
You should block all of these at your border router.



More information about the Snort-users mailing list