[Snort-users] Alerts of the ICMP relationship with smtp connection?
listassec at ...131...
Mon Jun 6 12:52:09 EDT 2005
How can I to confirm this? The alerts are ICMP type 8.
Thanks by help again.
--- Frank Knobbe <frank at ...9761...> wrote:
> On Mon, 2005-05-30 at 13:40 -0700, Paulo wrote:
> > I didn't solve this yet. Please, anyone can help
> Maybe you didn't get responses because it's not a
> Snort related issue.
> To answer your question, read up on Path Maximum
> Transmit Unit (PMTU)
> Discovery by googling it. Here a couple links that
> Google spit out right
> which also references
> While you are learning about PTMU, please review
> your firewall rule set
> and make sure you don't block ALL inbound ICMP
> packets. Please let at
> least type 3 and type 11 ICMP packets through.
> (Hint: The remote mail servers are sending a large
> ICMP packet in order
> to discover the MTU between them and you. It is
> harmless traffic.)
> Hope that helps,
Find restaurants, movies, travel and more fun for the weekend. Check it out!
More information about the Snort-users