[Snort-users] plz help

Jose Maria Lopez jkerouac at ...12346...
Thu Oct 14 15:03:35 EDT 2004


El jue, 14 de 10 de 2004 a las 09:48, Chandana Bandara escribió:
> hi , 
>  
> my snort placed in same network with the other machines. It has only
> one interface card. 
>  
>  
> PC A --------- PC B ------------- PC C -------- Snort Box -------- PC
> D --------- ....... so on
>  
> I made ping request PC B to PC D . It is not a nornal ping , added the
> packect size 50 000. This can be unknown attack in the network .
> But like this alerts why can't detect from the snort ? my snort wont
> show such hits ? where is the problem ? can u all help ....plz ?

It snort working OK with other kind of attacks? Maybe you have
deactivated the rules for ICMP, it's something quite common.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac at ...12346...
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"





More information about the Snort-users mailing list