[Snort-users] ICMP L3retriever Ping

Jordan, Jason A Jason.Jordan at ...10803...
Mon Dec 22 04:28:01 EST 2003

It active directory related - if you have Win XP systems/and possibly win2000 as well, you will have these.  You might
want to examine your rule and/or look and see if the "computer browser" service is enabled on non-domain controllers
(i.e. all the workstations, etc).


-----Original Message-----
From: Özgüç Bayrak [mailto:ozguc.bayrak at ...10801...] 
Sent: Monday, December 22, 2003 3:36 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] ICMP L3retriever Ping

There are a lot of "ICMP L3retriever Ping" alerts in my snort logs. Does anyone know anything about this? (There isn't
any symantec L3retriever scanner in my network.) Is that a trojan or a virus? Please help me.

More information about the Snort-users mailing list