[Snort-users] ICMP: Destination Unreachable
jean-baptiste.lallement at ...1699...
Thu Apr 5 12:00:12 EDT 2001
At 05/04/2001 17:01, Tom Sevy wrote:
>I don't wish to stop the logging of this message, but rather would like to
>find out why I am seeing this:
>Apr 4 23:59:45 snort: ICMP Destination Unreachable: 111.222.333.444
>(nt2118wk) -> 184.108.40.206(NT401PRD)
>Yet I can go to nt2118wk and ping NT401PRD and it will work.
>Any thoughts on what could be causing this kind of false positive? Or a way
>to determine what exactly on my network is giving the message back to
>nt2118wk about destination unreachable?
I had logs full a those messages caused by a 10Mo switch on a 100Mo LAN.
The slow switch couldn't handle trafic and send ICMP Host unreachable.
Since it was replaced Host unreachable decreased in a significant way.
More information about the Snort-users