[Snort-users] ICMP Source Quench

twig les twigles at ...131...
Mon Jul 7 12:19:19 EDT 2003


Yahoo still has a search engine?  ;-)

--- Bryan Waters <bryanw at ...9616...> wrote:
> Of course...but I did my search on yahoo and the results were
> so noisy that
> I couldn't find anything specific on the topic.  Also...I
> would have thought
> that Snort would have had at least a blurb in the online rule
> docs...since
> they didn't and the yahoo results were so bad, i didn't push
> it figuring it
> was something rather esoteric.
> 
> -bryanw
> 
> -----Original Message-----
> From: Chris Green [mailto:cmg at ...1935...]
> Sent: Monday, July 07, 2003 9:08 AM
> To: Bryan Waters
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] ICMP Source Quench
> 
> 
> "Bryan Waters" <bryanw at ...9616...> writes:
> 
> > What is an "ICMP Source Quench"?
> >
> > I have snort running and its working fine...i'm just looking
> for a place
> to
> > determine what some of the more poorly documented rules
> are...so i can get
> > an idea of what exactly is happening and how much of a
> threat it is...
> 
> Please tell me you atleast did (Lie if you have to :-)):
> 
> http://www.google.com/search?hl=en&query=ICMP+Source+Quench.
> 
> http://www.firewall.cx/icmp-source-quench.php
> 
> The additional $0.02 from experience:
> 
> Often times if you see ICMP source quenches your network is
> either
> flooding a particular network OR you netblock is being spoofed
> and
> some poor old sod is being flooded and can only yell at you
> about it.
> 
> Try reverse dns on the Source IP and if it's an IRC server,
> it's probably
> the latter.
> --
> Chris Green <cmg at ...1935...>
> Fame may be fleeting but obscurity is forever.
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites
> including
> Data Reports, E-commerce, Portals, and Forums are available
> now.
> Download today and enter to win an XBOX or Visual Studio .NET.
>
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


=====
-----------------------------------------------------------
Emo is what happens when the glee club goes punk.       
-----------------------------------------------------------

__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com




More information about the Snort-users mailing list