[Snort-users] IP short header
sales at ...4295...
Sat Mar 2 16:47:35 EST 2002
John replied to our question...
"Well, the short answer that doesn't tell you much is that the IP
header is expected to be 20 bytes long.
What you're receiving is only 18 long, and it triggers a rule in
-- hmm.. I can't grep for 'short header' in *.rules -- what version of
snort did you say you were running, and what platform ;-) ?"
Sorry John Sunday morning here and didn't want to spend all day in front of
the screen :)
Snorts running on one of our Cobalt RaQ's and it's vers 1.8.3 and the
latest rules were loaded on yesterday.
I figure it was expecting a certain header length but didn't know what the
default size was. But as I said I've been running it for months now and
never came across this in logcheck.
The same day that came through there were a lot of SCAN FINS recorded by
snorts logs and more than my usual share of ICMP Source Quenches and port
scans whether that has anything to do with it or not?
More information about the Snort-users