[Snort-users] ICMP: Destination Unreachable

JB Lallement jean-baptiste.lallement at ...1699...
Thu Apr 5 12:00:12 EDT 2001

At 05/04/2001 17:01, Tom Sevy wrote:
>I don't wish to stop the logging of this message, but rather would like to
>find out why I am seeing this:
>Apr  4 23:59:45 snort[3164]: ICMP Destination Unreachable: 111.222.333.444
>(nt2118wk)  ->
>Yet I can go to nt2118wk and ping NT401PRD and it will work.
>Any thoughts on what could be causing this kind of false positive?  Or a way
>to determine what exactly on my network is giving the message back to
>nt2118wk about destination unreachable?
Hi Tom,

I had logs full a those messages caused by a 10Mo switch on a 100Mo LAN. 
The slow switch couldn't handle trafic and send ICMP Host unreachable. 
Since it was replaced Host unreachable decreased in a significant way.


More information about the Snort-users mailing list