[Snort-users] "icmp-over-panic"

Basil Saragoza snortlst at ...125...
Thu Mar 7 11:20:07 EST 2002


I just pinged novell.com and received reply from 192.233.80.9
After that I noticed in ACID entry "ICMP echo reply"
in snort lan sensor in "misc-acivity" sesction....
Why should I and why should snort care about the legitimate ping echo
replies?
thx.




More information about the Snort-users mailing list