[Snort-users] ICMP Source Quench

McCammon, Keith Keith.McCammon at ...3497...
Tue Aug 27 07:08:04 EDT 2002


> An "ICMP Source Quench" message is sent by a host that is receiving
> datagrams (UDP) at too fast of a rate to process.

Or TCP, or any other IP-based protocol.  The SQ doesn't discriminate.  This is why we need to know what type of connection existed, and what application was in use before making a determination.  But yes, it is an indication of a generally hurting IP stack.




More information about the Snort-users mailing list