[Snort-users] Strange PATH MTU Traffic

Joshua Berry jberry at ...11848...
Mon Apr 25 08:57:32 EDT 2005


I am getting this alert: ICMP PATH MTU denial of service

I have never had this alert previous to this weekend, and have received
40,000 within the last 8 hours.  Some of this traffic appears to be
encrypted, the rest of it is hitting our domain controllers and contains
schema information.

I know Microsoft does some screwy stuff but I have never seen schema
information transmitted in an ICMP packet, much less a path mtu
discovery packet.

Anyone else seen this type of traffic?
 
Josh Berry | CISSP GCIA 
Information Security
214-765-1296
 
-------------------------------------------------------------------- 
If you spend more on coffee than on IT security, you will be hacked. 
What's more, you deserve to be hacked. 
     -- (Former) White House Cybersecurity adviser Richard Clarke 





More information about the Snort-users mailing list