[Snort-users] ICMP: Destination Unreachable

JB Lallement jean-baptiste.lallement at ...1699...
Thu Apr 5 12:00:12 EDT 2001


At 05/04/2001 17:01, Tom Sevy wrote:
>I don't wish to stop the logging of this message, but rather would like to
>find out why I am seeing this:
>
>Apr  4 23:59:45 snort[3164]: ICMP Destination Unreachable: 111.222.333.444
>(nt2118wk)  -> 55.66.77.88(NT401PRD)
>
>Yet I can go to nt2118wk and ping NT401PRD and it will work.
>
>Any thoughts on what could be causing this kind of false positive?  Or a way
>to determine what exactly on my network is giving the message back to
>nt2118wk about destination unreachable?
>
Hi Tom,

I had logs full a those messages caused by a 10Mo switch on a 100Mo LAN. 
The slow switch couldn't handle trafic and send ICMP Host unreachable. 
Since it was replaced Host unreachable decreased in a significant way.

JB






More information about the Snort-users mailing list