[Snort-users] ICMP Packets.

Jim Burwell jimb at ...6373...
Mon Aug 26 19:11:04 EDT 2002


Heh. Interesting. This was in ICMP ? It looks like a JPEG image header 
if I'm not mistaken.

- Jim


larosa, vjay wrote:

>Anybody recognize this payload? It is part of an ICMP packet. I have
>searched google 
>and haven't found any reason why I would see this data in an ICMP echo
>packet. 
>Awfull suspicous....
>
>vjl
>
>FF D8 FF FE 00 08 57 41 4E 47 32 02 FF E0 00 10   ......WANG2.....
>4A 46 49 46 00 01 01 01 00 60 00 60 00 00 FF DB   JFIF.....`.`....
>00 43 00 10 0B 0C 0E 0C 0A 10 0E 0D 0E 12 11 10   .C.............
>13 18 28 1A 18 16 16 18 31 23 25 1D 28 3A 33 3D   ..(.....1#%.(:3=
>3C 39 33 38 37 40 48 5C 4E 40 44 57 45 37 38 50   <9387 at ...2576...\N at ...6706...
>6D 51 57 5F 62 67 68 67 3E 4D 71 79 70 64 78 5C   mQW_bghg>Mqypdx\
>65 67 63 FF DB 00 43 01 11 12 12 18 15 18 2F 1A   egc...C......./.
>1A 2F 63 42 38 42 63 63 63 63 63 63 63 63 63 63   ./cB8Bcccccccccc
>63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63   cccccccccccccccc
>63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63   cccccccccccccccc
>63 63 63 63 63 63 63 63 FF C0 00 11 08 00 26 00   cccccccc......&.
>9E 03 01 21 00 02 11 01 03 11 01 FF C4 00 1F 00   ...!............
>00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00   ................
>00 01 02 03 04 05 06 07 08 09 0A 0B FF C4 00 B5   ................
>10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01   ................
>7D 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61   }........!1A..Qa
>07 22 71 14 32 81 91 A1 08 23 42 B1 C1 15 52 D1   ."q.2....#B...R.
>F0 24 33 62 72 82 09 0A 16 17 18 19 1A 25 26 27   .$3br........%&'
>28 29 2A 34 35 36 37 38 39 3A 43 44 45 46 47 48   ()*456789:CDEFGH
>49 4A 53 54 55 56 57 58 59 5A 63 64 65 66 67 68   IJSTUVWXYZcdefgh
>69 6A 73 74 75 76 77 78 79 7A 83 84 85 86 87 88   ijstuvwxyz......
>89 8A 92 93 94 95 96 97 98 99 9A A2 A3 A4 A5 A6   ................
>A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4   ................
>C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E1   ................
>E2 E3 E4 E5 E6 E7 E8 E9 EA F1 F2 F3 F4 F5 F6 F7   ................
>F8 F9 FA FF C4 00 1F 01 00 03 01 01 01 01 01 01   ................
>01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07   ................
>08 09 0A 0B FF C4 00 B5 11 00 02 01 02 04 04 03   ................
>04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05   ........w.......
>21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42   !1..AQ.aq."2...B
>91 A1 B1 C1 09 23 33 52 F0 15 62 72 D1 0A 16 24   .....#3R..br...$
>34 E1 25 F1 17 18 19 1A 26 27 28 29 2A 35 36 37   4.%.....&'()*567
>38 39 3A 43 44 45 46 47 48 49 4A 53 54 55 56 57   89:CDEFGHIJSTUVW
>58 59 5A 63 64 65 66 67 68 69 6A 73 74 75 76 77   XYZcdefghijstuvw
>78 79 7A 82 83 84 85 86 87 88 89 8A 92 93 94 95   xyz.............
>96 97 98 99 9A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3   ................
>B4 B5 B6 B7 B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA   ................
>D2 D3 D4 D5 D6 D7 D8 D9 DA E2 E3 E4 E5 E6 E7 E8   ................
>E9 EA F2 F3 F4 F5 F6 F7 F8 F9 FA FF DA 00 0C 03   ................
>01 00 02 11 03 11 00 3F 00 ED 35 6D 4A 1D 23 4D   .......?..5mJ.#M
>96 FA E1 64 68 A2 C6 E1 18 05 B9 20 71 92 3D 6A   ...dh...... q.=j
>AE 81 E2 2B 2F 10 47 33 59 89 50 C2 40 74 95 40   ...+/.G3Y.P. at ...6707...@
>23 3D 0F 04 8E C7 BF 6A 00 D6 AE 75 FC 67 A6 2E   #=.....j...u.g..
>B6 34 A5 8E E5 E6 F3 C4 1B D5 06 CD E4 E3 B9 CF   .4..............
>07 8E 9D BB D0 06 86 A7 AD DB 69 77 B6 16 B3 A4   ..........iw....
>AC F7 D2 79 71 94 00 80 72 A3 9C 91 FD E1 EB 5A   ...yq...r......Z
>54 00 51 40 05 14 00 51 40 05 14 00 51 40 0D 92   T.Q at ...6708...@...Q at ...843...
>44 8A 36 92 47 54 44 05 99 98 E0 28 1D 49 35 CC   D.6.GTD....(.I5.
>DB F8 F3 49 B9 D4 62 B3 86 2B B6 69 65 11 24 9B   ...I..b..+.ie.$.
>14 29 24 E0 1E 5B 38 FC 33 ED 40 1B D6 BA 8D A5   .)$..[8.3. at ...568...
>E5 D5 CD B5 B4 EB 24 B6 A4 2C CA A0 FC 84 E7 8C   ......$..,......
>F4 3D 0F 4E 98 AB 54 01 CF F8 EF FE 45 0B EF FB   .=.N..T.....E...
>67 FF 00 A3 16 B9 9F 0C 11 A1 F8 A2 C6 1D CA 96   g...............
>FA A5 84 4E 07 98 40 0E 50 1C 90 7A 92 CA C0 0F   ...N.. at ...6709...
>F6 F8 F4 A0 0E F3 53 BD 4D 37 4D B9 BD 93 69 10   ......S.M7M...i.
>46 5F 6B 36 DD C4 0E 17 3E E7 03 F1 AF 2D D3 AC   F_k6....>....-..
>DA 39 FC 3B A8 4C DB E7 BE D4 19 DA 42 C4 B3 05   .9.;.L......B...
>78 C7 39 EF BB 79 FC 68 03 D1 35 AD 77 FB 27 51   x.9..y.h..5.w.'Q
>D2 ED 3E CD E6 FD BE 5F 2F 76 FD BB 39 51 9C 60   ..>...._/v..9Q.`
>E7 EF 7B 74 AB 5A BE AF 69 A2 D9 7D AA F5 D9 50   ..{t.Z..i..}...P
>9D AA 15 49 2C D8 24 01 F5 C1 EB 81 40 1C EF FC   ...I,.$..... at ...979...
>27 13 47 FE 91 71 A0 5F 47 A7 9E 45 CE 0F 2A 7E   '.G..q._G..E..*~
>E9 C1 00 73 91 FC 5D FB D7 45 2E A9 07 F6 24 BA   ...s..]..E....$.
>A5 AB 2D C4 29 03 4C BB 4E 37 6D 04 E3 DB A6 3D   ..-.).L.N7m....=
>A8 03 9D B6 F1 C4 D7 E9 00 D3 74 49 EE E7 6F F5   ..........tI..o.
>C8 8E 76 C2 4B 10 A0 B6 DC 72 06 72 70 07 AF 5C   ..v.K....r.rp..\
>6D 78 83 C4 16 9A 05 A8 92 E7 73 CB 20 6F 26 25   mx........s. o&%
>07 F7 84 63 BF 41 D4 75 FD 7A 50 06 2A F8 DE E2   ...c.A.u.zP.*...
>DE 68 8E AB A0 DD D8 5A BB EC 69 DF 71 0A 4F B1   .h.....Z..i.q.O.
>51 9F E7 8C F5 AE 99 F5 1B 48 F4 D1 A8 C9 3A A5   Q........H....:.
>A1 8C 4B E6 30 23 E5 23 23 8E BC E4 71 D6 80 39   ..K.0#.##...q..9
>9F F8 4D 6F 2E 3F 7B A7 F8 6E FA E6 D5 BE E4 BC   ..Mo.?{..n......
>8D DE BD 14 8E B9 1D 7B 56 C7 87 3C 45 6B E2 1B   .......{V..<Ek..
>79 1E DD 24 8A 58 76 89 63 71 F7 49 1D 8F 71 C1   y..$.Xv.cq.I..q.
>F4 3C 74 14 01 1F 88 7C 4D 6F A2 32 5B AC 32 5D   .<t....|Mo.2[.2]
>5F 4B B7 CB B6 40 41 60 49 19 CE 0F A1 18 19 39   _K... at ...2614...`I......9
>C7 1D EB 36 0F 1C 18 6E 92 3D 6B 49 B9 D2 E2 90   ...6...n.=kI....
>1D B2 C8 19 B2 47 B6 D0 7F 2C F5 1F 5A 00 B9 E3   .....G..?,..Z...
>4D 4A E6 CB 4A 92 08 34 E9 6E 92 E6 09 52 49 53   MJ..J..4.n...RIS
>38 80 6D C6 E3 80 7D 49 ED D2 B9 BF 0C 78 82 FF   8.m...}I.....x..
>00 4D D0 E1 B7 B4 F0 DD CD D2 65 98 DC 44 18 09   .M........e..D..
>09 63 CF 08 73 8E 07 5E D4 01 5F C3 FA F5 FD 96   .c..s..^.._.....
>AB AC 4F 06 87 73 74 F7 33 EF 92 24 DD 98 0E E7   ..O..st.3..$....
>3B 4E 14 FA 91 DB A5 7A 75 00 73 FE 3B FF 00 91   ;N.....zu.s.;...
>42 FB FE D9 FF 00 E8 C5 AC 1F 11 DB 4A BE 0E D0   B...........J...
>75 5B 62 C2 6B 08 E1 60 DC 61 41 55 E7 07 AF CC   u[b.k..`.aAU....
>13 F3 34 01 6B C6 FA 93 5F 68 7A 65 A5 92 C9 BF   ..4.k..._hze....
>56 74 64 56 0A 32 BC 10 A4 93 C1 DC C9 F9 1E 7D   VtdV.2.........}
>5B E2 8B 64 B3 D5 7C 23 6B 19 62 90 4E 23 52 DD   [..d..|#k.b.N#R.
>48 0D 10 19 FC A8 02 6F 1A 7F C8 C3 E1 8F FA FB   H.....o.?......
>FF 00 D9 E3 A8 FC 45 0A EA 3E 3F D1 B4 FB 93 BA   ......E..>?.....
>D5 62 33 79 78 18 27 E6 27 39 1C 83 B1 41 1E 94   .b3yx.'.'9...A..
>01 D8 5C 41 1D CD BC B6 F3 2E E8 A5 42 8E B9 C6   ..\A........B...
>41 18 23 8A C3 97 48 87 44 F0 7E A7 67 6F 34 F2   A.#...H.D.~.go4.
>C5 F6 79 99 7C E6 0C 57 28 78 18 03 03 BF D4 9A   ..y.|..W(x......
>00 6F 80 63 44 F0 95 9B 22 2A 97 32 33 10 31 B8   .o.cD..."*.23.1.
>EF 61 93 EB C0 03 F0 AC D4 85 75 1F 8A 17 02 E8   .a........u.....
>EF 5B 1B 75 78 54 81 80 70 B8 CF 1C E0 BB 1F 5C   .[.uxT..p......\
>E3 D2 80 3A CB FB 28 75 1B 19 EC EE 17 31 4C 85   ...:..(u.....1L.
>5B 81 91 EE 33 DC 75 1E E2 B8 9F 0C 59 CF AE FC   [...3.u.....Y...
>3E BC D3 44 CA 84 4E 52 22 CB C2 E0 AB E0 E3 D4   >..D..NR".......
>93 CF 3D 7D B1 40 10 DB F8 9B 5F F0 CD BC 56 9A   ..=}. at ...6710...
>B6 93 BE DE 04 11 24 9C A6 4E 32 A3 78 CA 9C 0E   ......$..N2.x...
>30 06 78 F6 35 B9 E1 AD 43 C3 DA A6 AF 73 77 A6   0.x.5...C....sw.
>DB C9 06 A1 22 13 28 75 20 B2 E5 72 D8 04 AF 27   ....".(u ..r...'
>1E F9 CD 00 53 F0 BC 2B 7B E3 3D 7A FE E4 EF 9E   ....S..+{.=z....
>DA 5F 26 32 40 C2 8C B2 FA 75 0A 80 67 D0 9E B9   ._&2 at ...6711...
>AD CF 16 D9 43 7B E1 AB E5 99 73 E5 44 D3 21 00   ....C{....s.D.!.
>65 59 41 23 19 E9 D3 1F 42 68 03 2F 4B 9E 4B 8F   eYA#....Bh./K.K.
>86 4E F2 B6 E6 16 53 A0 38 C7 0A 19 40 FC 80 AB   .N....S.8... at ...979...
>9E 04 FF 00 91 42 C7 FE DA 7F E8 C6 A0 0C FF 00   .....B...?......
>05 FF 00 C8 C3 E2 7F FA FB FF 00 D9 E4 AE C2 80   ......?.........
>39 FF 00 1D FF 00 C8 A1 7D FF 00 6C FF 00 F4 62   9.......}..l...b
>D4 D6 56 49 A9 78 2E D6 CA 4D A0 4F 61 1A 6E 65   ..VI.x...M.Oa.ne
>DD B4 94 18 6C 7B 1C 1F C2 80 38 DF 05 C1 36 A1   ....l{....8...6.
>AD D9 43 71 14 89 16 8F 13 EE 49 14 95 F3 0B B1   ..Cq......I.....
>E4 1F BA DF 37 D7 F7 7F 96 E7 8D 3F E4 61 F0 C7   ....7..?...?.a..
>FD 7D FF 00 EC F1 D0 01 E3 4F F9 18 7C 31 FF 00   .}.......O..|1..
>5F 7F FB 3C 75 37 8C 2C 2F 62 BA B2 D7 74 88 5A   _?.<u7.,/b...t.Z
>5B DB 43 B1 91 50 BE F4 39 ED 9E D9 23 81 9F 9B   [.C..P..9...#...
>39 18 A0 0A BF F0 B0 61 BA B7 F2 B4 FD 36 EE 5D   9......a.....6.]
>41 D3 E4 8B 68 65 DD 8E 7A 1C 90 39 3D 06 71 DB   A...he..z..9=.q.
>B5 E8 6C 6F 6C 3C 0B 7F 1E A5 71 2C F7 6F 6D 33   ..lol<.?..q,.om3
>C8 64 94 C9 B3 28 70 A0 FB 00 3D 79 CD 00 4D E0   .d...(p...=y..M.
>4F F9 14 2C 7F ED A7 FE 8C 6A CD F1 35 9D EE 91   O..,?....j..5...
>AF 47 E2 4D 36 06 99 16 32 2F 23 0C 46 54 60 64   .G.M6...2/#.FT`d
>F3 9E 98 E8 30 36 64 D0 04 77 7E 35 3A BD AC 96   ....06d..w~5:...
>3E 1F B1 BC 92 F6 61 B0 33 28 5F 2D 4F 05 B2 AC   >.....a.3(_-O...
>
>V.Jay LaRosa                           EMC Corporation
>Information Security                  171 South Street
>(508)249-3355 office                  Hopkinton, MA 01748
>(508)498-5575 cell                     www.emc.com
>(888-799-9750 pager                  larosa_vjay at ...3331...
>(508)497-8082 fax
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by: OSDN - Tired of that same old
>cell phone?  Get a new here for FREE!
>https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users
>






More information about the Snort-users mailing list