[Snort-users] Embedded Fragment?
dholden at ...2819...
Tue Feb 19 23:42:04 EST 2002
I appreciate the help.
I've been getting these from 192... for the last 2 days (158 so far) and
they don't seem to have any frequency pattern (like every hour or every five
Here's a hex dump from snort (actually demarc):
45 00 00 40 81 3D 00 40 37 06 85 81 D1 8E 27 A0 E.. at ...843...=. at ...5023...'.
CC 98 BB 02 98 0A 00 71 B9 E2 C0 10 .....
And the decoded payload:
E.. at ...843...=. at ...5023...'......
----- Original Message -----
From: "Glenn Forbes Fleming Larratt" <glratt at ...4500...>
To: <snort-users at lists.sourceforge.net>
Sent: Tuesday, February 19, 2002 11:07 PM
Subject: Re: [Snort-users] Embedded Fragment?
> On Tue, 19 Feb 2002, Daniel Holden wrote:
> > Can someone tell me (or point me to the docs) what the following means?
> > Feb 19 21:52:52 crow kernel: ipt_unclean: (embedded packet) Embedded
> > fragment.
> > Feb 19 21:52:51 crow kernel: IN=eth0 OUT= MAC=uglyMacAddressHere
> > SRC=22.214.171.124 DST=126.96.36.199 LEN=56 TOS=0x00 PREC=0x00 TTL=245
> > ID=22342 DF PROTO=ICMP TYPE=3 CODE=13 [SRC=188.8.131.52
> > LEN=64 TOS=0x00 PREC=0x00 TTL=55 ID=47316 FRAG:64 PROTO=TCP ]
> It's opaque to me whether your system "crow" is generating,
> recording, or dropping the packet in question, but:
> - The packet itself is an ICMP 3/13 packet, meaning type 3, code 13
> (see http://www.iana.org/assignments/icmp-parameters); type 3 is
> "destination unreachable", code 13 is "Communication Administratively
> Prohibited", i.e. an ACL, probably on host 184.108.40.206, dropped a packet
> from host 220.127.116.11.
> - A truncated portion of the packet that was dropped is included *within*
> the ICMP packet; enough to discern that it was a 64-byte fragment of a TCP
> packet, from host 18.104.22.168 to host 22.214.171.124 .
> - What's it all mean? A 64-byte fragment either implies a final fragment
> or an extraordinarily short-MTU segment in the path - or crafted
> for some probably unfriendly purpose. Need more data (like a hex dump -
> Snort ;) .
> > Thank you
> > Daniel Holden
> > dholden at ...2819...
> > http://www.idsb.net
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> Glenn Forbes Fleming Larratt glratt at ...604...
> There are imaginary bugs to chase in heaven.
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
More information about the Snort-users