[Snort-users] single IP icmp alert rule error

Erick Mechler emechler at ...7719...
Thu Jan 30 13:25:04 EST 2003


:: (more or less)
:: alert icmp any any -> $HOME_NET any (msg:"test of ping";)
:: 
:: I then issued a ping from a remote machine against 192.168.1.101 ..
:: from 192.168.1.100.  This worked fine.  The log reported the alert.

Do you have any NAT going on?  Revert your signature to the one above, run
the ping again, and look at what hosts are involved in the alert.  That
might help you figure this out.

Cheers - Erick
k




More information about the Snort-users mailing list