[Snort-users] L3 Retriever Ping False Alarms

netsec novice netsec9 at ...125...
Fri Dec 20 10:53:02 EST 2002

I get the same thing with XP proffesional hosts to a NT4 domain controller.  
I am also wondering why this traffic is occurring.

>From: "Parker, Ian" <parker.ian at ...6018...>
>To: "'snort-users at lists.sourceforge.net'" 
><snort-users at lists.sourceforge.net>
>Subject: [Snort-users] L3 Retriever Ping False Alarms
>Date: Thu, 19 Dec 2002 16:17:38 -0700
>Does anybody what causes Win2K hosts to issue pings that look like L3
>Retriever Pings? When I do a regular ping, the payload is all zeros.
>However, something else in the system is sending pings with the
>characteristic L3 Retriever payload of "ABCDEFG...." etc.
>Ian Parker, GCWN
>Senior Systems Analyst
>Upgrading Plant Computing
>Syncrude Canada Ltd
>parker.ian at ...6018...
>This SF.NET email is sponsored by: Geek Gift Procrastinating?
>Get the perfect geek gift now!  Before the Holidays pass you by.
>T H I N K G E E K . C O M      http://www.thinkgeek.com/sf/
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:

Add photos to your messages with MSN 8. Get 2 months FREE*. 

More information about the Snort-users mailing list