[Snort-users] Strange Traffic Flow
jeff-kell at ...6282...
Fri Oct 14 18:16:24 EDT 2005
Frank Knobbe wrote:
> On Fri, 2005-10-14 at 07:02 -0700, Theodore Stout wrote:
>>It's claiming that one host is sending large ICMP
>>packets to my DC, and the DC answers back with the
>>same large ICMP packet.
>>Why would that be?
> That's normal. Google for "slow link detection domain controller".
[Some? Most? At least our] SAP/R3 applications send out big fat pings instead of tcp keepalives.
More information about the Snort-users