[Snort-users] some strange alerts

dawnshade h-k at ...1975...
Tue Apr 15 22:43:05 EDT 2003


Hello, All.

After installing snort 2.0 i see many strange alerts like this:
--------------------------------------
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]
04/16/03-04:00:17.143503 111.119.49.57 -> 46.114.111.115                       
IPX-IN-IP TTL:77 TOS:0xB4 ID:1 IpLen:8 DgmLen:35535                            
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:18.843381 255.255.55.217 -> 130.150.200.254                     
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:28.843456 255.255.55.217 -> 170.23.88.1                         
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:38.842883 255.255.55.217 -> 209.152.200.254                     
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:48.886830 255.255.55.217 -> 249.69.101.100                      
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:00:58.887032 255.255.55.218 -> 32.198.248.91                       
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:01:08.886991 255.255.55.218 -> 72.71.200.254                       
MFE-NSP TTL:0 TOS:0x0 ID:7 IpLen:0 DgmLen:2 RB DF                              
                                                                               
[**] [116:1:1]  <cp0> (snort_decoder) WARNING: Not IPv4 datagram! [**]         
04/16/03-04:01:17.142097 111.119.49.57 -> 46.114.111.115                       
IPX-IN-IP TTL:77 TOS:0xB4 ID:1 IpLen:8 DgmLen:35535
-------------------------------------------

Any ideas about it????
  

----------
Best regards,
 dawnshade                            mailto:h-k at ...1975...





More information about the Snort-users mailing list