[Snort-users] ICMP Source Quench

Wirth, Jeff WirthJe at ...4876...
Tue Aug 27 06:42:05 EDT 2002


> From: Sergei Balyakin [mailto:sergei at ...6719...]
> 
> Hi!
> 
> Does anyone knows what it means. Too many messages last some days.
> Thankx in advance.
> 
> [**] ICMP Source Quench [**]
> 08/26-11:26:25.412038 195.161.172.228 -> 213.152.133.10
> ICMP TTL:247 TOS:0x0 ID:45317 IpLen:20 DgmLen:56
> Type:4  Code:0  SOURCE QUENCH
> 00 00 00 00 45 00 05 DC 5F C5 40 00 36 06 27 DF  ....E..._. at ...6720...'.
> D5 98 85 0A D9 6B 83 69 00 50 04 04 29 71 38 2C  .....k.i.P..)q8,
> 
An "ICMP Source Quench" message is sent by a host that is receiving
datagrams (UDP) at too fast of a rate to process.  *Could* be an indication
of a server under heavy load.

- Jeff




More information about the Snort-users mailing list