[Snort-users] frag3 alerts

Drew Burchett DrewB at ...13821...
Mon May 22 09:19:06 EDT 2006

I am seeing a lot of frag3 Fragmentation overlap alerts with my DNS
server as the destination and a source address that reverses to a root
server.  When examining the packets, the traffic seems to be valid DNS
traffic, although it has nothing to do with any domains that I host.  Is
this some sort of attack, or is it valid traffic that is throwing false
positives?  If it is a false positive, is there any way I can fine-tune
the frag3 preprocessor to avoid these?


Drew Burchett

United Systems & Software


Phone:  (270)527-3293

Fax:     (270)527-3132


CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

This message has been scanned for viruses and dangerous content by MailScanner and is believed to be clean.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20060522/32035d9f/attachment.html>

More information about the Snort-users mailing list