[Snort-users] Alert Question

Ju Kong Fui kongfui at ...3775...
Wed Nov 28 22:56:03 EST 2001

The remote network was not pinging your network.

Someone in your internal network was trying to communicate with a host in, and the router is telling your router
that this host is not reachable (by sending icmp host unreachable).

-----Original Message-----
From: Lists [mailto:lists at ...2694...] 
Sent: Thursday, November 29, 2001 2:06 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Alert Question

Hello all. I was wondering if someone can help me to understand the alerts I
am seeing in Snort.

They come every 3 minutes and here is the alert-
11/29-12:48 18.525622 [**] [1:399] <\Device\Packet_> ICMP Destination
Unreachable (Host Unreachable) [**] {ICMP} -> is the internal router seperating the my internal network from the
DMZ network. I can't move Snort to the Internal network because it is
switched (switches without SPAN type ports). So, I can't find out what
machine on the inside is receiving these.

I ran a WHOIS on the address- -

UUNET Technologies, Inc.
3060 Williams Drive
Fairfax, VA 22031

So, why is UUNET pinging me every 3 minutes?

Can anybody help with this?

Thanks in advance.

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list