[Snort-users] Stopping ECHO & ECHO REPLY Alerts

Michael Pace mpace79 at ...131...
Mon Aug 16 07:49:55 EDT 2004


I am currently seeing hundreds of the alerts below, but I'm not sure what rule is causing them.  I don't really care to have an email sent to me every time someone does a basic echo request on my firewall.  I'd like to change the rule to log instead of alert.  Can anyone tell me where to look?
 
[Classification: Misc activity] [Priority: 3] 
08/11-07:29:02.490037 63.163.102.37 -> xxx.xxx.xxx.xxx
ICMP TTL:49 TOS:0x0 ID:27096 IpLen:20 DgmLen:64
Type:8  Code:0  ID:28958   Seq:512  ECHO

[Classification: Misc activity] [Priority: 3] 
08/11-07:29:49.362139 216.15.147.20 -> xxx.xxx.xxx.xxx
ICMP TTL:255 TOS:0x0 ID:19804 IpLen:20 DgmLen:36 DF
Type:0  Code:0  ID:32081  Seq:0  ECHO REPLY
 
 
Thanks,
 
Michael

		
---------------------------------
Do you Yahoo!?
Yahoo! Mail is new and improved - Check it out!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20040816/ce80c99a/attachment.html>


More information about the Snort-users mailing list