[Snort-users] Strange Traffic Flow

Jeff Kell jeff-kell at ...6282...
Fri Oct 14 18:16:24 EDT 2005

Frank Knobbe wrote:
> On Fri, 2005-10-14 at 07:02 -0700, Theodore Stout wrote:
>>It's claiming that one host is sending large ICMP
>>packets to my DC, and the DC answers back with the
>>same large ICMP packet. 
>>Why would that be?

> That's normal. Google for "slow link detection domain controller".

[Some? Most? At least our] SAP/R3 applications send out big fat pings instead of tcp keepalives.  


More information about the Snort-users mailing list