[Snort-users] Bad Traffic Same SRC/DST PROTO106 QNX???

counter.spy at ...348... counter.spy at ...348...
Mon Feb 4 04:53:14 EST 2002

Snort generated this alert:
[**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
02/04-12:36:54.498592 ->
PROTO106 TTL:255 TOS:0x0 ID:0 IpLen:20 DgmLen:74

Very interesting, this one. The event occured when we checked out QNX (cool
OS), so I could figure out where it came from, when I checked with iana.org.

But I could not find any useful details about Proto 106.
Can anybody tell me what Proto 106 QNX (Reference "Hunter" hunter at ...4846...)
actually does?

If not, I think I will email Mr. Hunter, but I thought some users could
possibly see this alert, too, wondering what it is all about.

D. Liesen

GMX - Die Kommunikationsplattform im Internet.

More information about the Snort-users mailing list