[Snort-users] Embedded Fragment?

Glenn Forbes Fleming Larratt glratt at ...4500...
Tue Feb 19 23:08:04 EST 2002

On Tue, 19 Feb 2002, Daniel Holden wrote:

> Can someone tell me (or point me to the docs) what the following means?
> Feb 19 21:52:52 crow kernel: ipt_unclean: (embedded packet) Embedded
> fragment.
> Feb 19 21:52:51 crow kernel: IN=eth0 OUT= MAC=uglyMacAddressHere
> SRC= DST= LEN=56 TOS=0x00 PREC=0x00 TTL=245
> LEN=64 TOS=0x00 PREC=0x00 TTL=55 ID=47316 FRAG:64 PROTO=TCP ]

	It's opaque to me whether your system "crow" is generating,
	recording, or dropping the packet in question, but:

- The packet itself is an ICMP 3/13 packet, meaning type 3, code 13
(see http://www.iana.org/assignments/icmp-parameters); type 3 is
"destination unreachable", code 13 is "Communication Administratively
Prohibited", i.e. an ACL, probably on host, dropped a packet
from host

- A truncated portion of the packet that was dropped is included *within*
the ICMP packet; enough to discern that it was a 64-byte fragment of a TCP
packet, from host to host .

- What's it all mean? A 64-byte fragment either implies a final fragment
or an extraordinarily short-MTU segment in the path - or crafted fragmentation
for some probably unfriendly purpose. Need more data (like a hex dump - from
Snort ;) .


> Thank you
> Daniel Holden
> dholden at ...2819...
> http://www.idsb.net
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Glenn Forbes Fleming Larratt          glratt at ...604...

There are imaginary bugs to chase in heaven.

More information about the Snort-users mailing list