[Snort-users] Embedded Fragment?

Daniel Holden dholden at ...2819...
Tue Feb 19 23:42:04 EST 2002


I appreciate the help.
I've been getting these from 192... for the last 2 days (158 so far) and
they don't seem to have any frequency pattern (like every hour or every five
minutes).

Here's a hex dump from snort (actually demarc):

45 00 00 40 81 3D 00 40 37 06 85 81 D1 8E 27 A0   E.. at ...843...=. at ...5023...'.
CC 98 BB 02 98 0A 00 71 B9 E2 C0 10               .....
.q....

And the decoded payload:
E.. at ...843...=. at ...5023...'......
.q....





----- Original Message -----
From: "Glenn Forbes Fleming Larratt" <glratt at ...4500...>
To: <snort-users at lists.sourceforge.net>
Sent: Tuesday, February 19, 2002 11:07 PM
Subject: Re: [Snort-users] Embedded Fragment?


> On Tue, 19 Feb 2002, Daniel Holden wrote:
>
> > Can someone tell me (or point me to the docs) what the following means?
> >
> > Feb 19 21:52:52 crow kernel: ipt_unclean: (embedded packet) Embedded
> > fragment.
> > Feb 19 21:52:51 crow kernel: IN=eth0 OUT= MAC=uglyMacAddressHere
> > SRC=192.5.4.146 DST=209.142.39.160 LEN=56 TOS=0x00 PREC=0x00 TTL=245
> > ID=22342 DF PROTO=ICMP TYPE=3 CODE=13 [SRC=209.142.39.160
DST=204.152.187.2
> > LEN=64 TOS=0x00 PREC=0x00 TTL=55 ID=47316 FRAG:64 PROTO=TCP ]
>
> It's opaque to me whether your system "crow" is generating,
> recording, or dropping the packet in question, but:
>
> - The packet itself is an ICMP 3/13 packet, meaning type 3, code 13
> (see http://www.iana.org/assignments/icmp-parameters); type 3 is
> "destination unreachable", code 13 is "Communication Administratively
> Prohibited", i.e. an ACL, probably on host 192.5.4.146, dropped a packet
> from host 209.142.39.160.
>
> - A truncated portion of the packet that was dropped is included *within*
> the ICMP packet; enough to discern that it was a 64-byte fragment of a TCP
> packet, from host 209.142.39.160 to host 204.152.187.2 .
>
> - What's it all mean? A 64-byte fragment either implies a final fragment
> or an extraordinarily short-MTU segment in the path - or crafted
fragmentation
> for some probably unfriendly purpose. Need more data (like a hex dump -
from
> Snort ;) .
>
> -g
>
>
> > Thank you
> > Daniel Holden
> > dholden at ...2819...
> > http://www.idsb.net
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
>
> Glenn Forbes Fleming Larratt          glratt at ...604...
> http://is.rice.edu/~glratt
>
> There are imaginary bugs to chase in heaven.
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>





More information about the Snort-users mailing list