[Snort-users] ICMP L3retriever Ping

Jordan, Jason A Jason.Jordan at ...10803...
Mon Dec 22 04:28:01 EST 2003


It active directory related - if you have Win XP systems/and possibly win2000 as well, you will have these.  You might
want to examine your rule and/or look and see if the "computer browser" service is enabled on non-domain controllers
(i.e. all the workstations, etc).

Jason

-----Original Message-----
From: Özgüç Bayrak [mailto:ozguc.bayrak at ...10801...] 
Sent: Monday, December 22, 2003 3:36 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] ICMP L3retriever Ping

Hi,
 
There are a lot of "ICMP L3retriever Ping" alerts in my snort logs. Does anyone know anything about this? (There isn't
any symantec L3retriever scanner in my network.) Is that a trojan or a virus? Please help me.
 
Thanks...




More information about the Snort-users mailing list