[Snort-users] IP short header

John Sage jsage at ...2022...
Sat Mar 2 15:56:04 EST 2002


Well, the short answer that doesn't tell you much is that the IP
header is expected to be 20 bytes long.

What you're receiving is only 18 long, and it triggers a rule in
-- hmm.. I can't grep for 'short header' in *.rules -- what version of
snort did you say you were running, and what platform ;-) ?

Do you have a full packet capture?


- John
-- 
Most people don't type their own logfiles;  but, what do I care?



On Sun, Mar 03, 2002 at 11:52:06AM +1300, Render-Vue wrote:
> 
> 
> Hi Yah,
> 
> Started seeing a lot of these show up in logcheck, have had snort running 
> for several months now and haven't seen these before.
> 
> Anything to be concerned about?
> 
> Mar  2 02:33:18 ns snort: ICMP Unreachable IP short header (18 bytes)
> Mar  2 02:40:09 ns snort: ICMP Unreachable IP short header (18 bytes)
> Mar  2 02:41:21 ns snort: ICMP Unreachable IP short header (18 bytes)
> Mar  2 02:44:28 ns snort: ICMP Unreachable IP short header (18 bytes)
> Mar  2 02:50:00 ns snort: ICMP Unreachable IP short header (18 bytes)
> Mar  2 03:33:05 ns snort: ICMP Unreachable IP short header (12 bytes)
> Mar  2 03:35:41 ns snort: ICMP Unreachable IP short header (18 bytes)
> Mar  2 06:15:42 ns snort: ICMP Unreachable IP short header (18 bytes)
> 
> Regards from Auckland
> 
> Chae




More information about the Snort-users mailing list