[Snort-users] ICMP Source Quench

McCammon, Keith Keith.McCammon at ...3497...
Tue Aug 27 06:24:07 EDT 2002


Hard to say for sure without seeing the traffic that preceded (or followed) the SQ message.  However, this generally means that 195.161.172.228 is experiencing congestion, and that 213.152.133.10 should reduce the amount of data that it is sending.  Most TCP implementation will respond in a manner similar to that of a TCP window size reduction.

While this can be sent in response to any protocol, SQ is generally associated with congestion control mechanisms in TCPs.

> -----Original Message-----
> From: Sergei Balyakin [mailto:sergei at ...6719...]
> Sent: Tuesday, August 27, 2002 9:16 AM
> To: snort-users-request at lists.sourceforge.net
> Subject: [Snort-users] ICMP Source Quench
> 
> 
> Hi!
> 
> Does anyone knows what it means. Too many messages last some days.
> Thankx in advance.
> 
> [**] ICMP Source Quench [**]
> 08/26-11:26:25.412038 195.161.172.228 -> 213.152.133.10
> ICMP TTL:247 TOS:0x0 ID:45317 IpLen:20 DgmLen:56
> Type:4  Code:0  SOURCE QUENCH
> 00 00 00 00 45 00 05 DC 5F C5 40 00 36 06 27 DF  ....E..._. at ...6720...'.
> D5 98 85 0A D9 6B 83 69 00 50 04 04 29 71 38 2C  .....k.i.P..)q8,
> 
> 
> 
> 
> 
> -- 
> Best regards,
>  Sergei                            mailto:sergei at ...6719...
> 
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by: OSDN - Tired of that same old
> cell phone?  Get a new here for FREE!
> https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 




More information about the Snort-users mailing list