[Snort-users] L3 Retriever Ping False Alarms

netsec novice netsec9 at ...125...
Fri Dec 20 10:53:02 EST 2002


I get the same thing with XP proffesional hosts to a NT4 domain controller.  
I am also wondering why this traffic is occurring.





>From: "Parker, Ian" <parker.ian at ...6018...>
>To: "'snort-users at lists.sourceforge.net'" 
><snort-users at lists.sourceforge.net>
>Subject: [Snort-users] L3 Retriever Ping False Alarms
>Date: Thu, 19 Dec 2002 16:17:38 -0700
>
>Does anybody what causes Win2K hosts to issue pings that look like L3
>Retriever Pings? When I do a regular ping, the payload is all zeros.
>However, something else in the system is sending pings with the
>characteristic L3 Retriever payload of "ABCDEFG...." etc.
>
>Ian Parker, GCWN
>
>Senior Systems Analyst
>Upgrading Plant Computing
>Syncrude Canada Ltd
>
>(780)790-4631
>parker.ian at ...6018...
>
>
>
>-------------------------------------------------------
>This SF.NET email is sponsored by: Geek Gift Procrastinating?
>Get the perfect geek gift now!  Before the Holidays pass you by.
>T H I N K G E E K . C O M      http://www.thinkgeek.com/sf/
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users


_________________________________________________________________
Add photos to your messages with MSN 8. Get 2 months FREE*. 
http://join.msn.com/?page=features/featuredemail&xAPID=42&PS=47575&PI=7324&DI=7474&SU= 
http://www.hotmail.msn.com/cgi-bin/getmsg&HL=1216hotmailtaglines_addphotos_3mf





More information about the Snort-users mailing list