[Snort-users] Everything being triggered as 1:486:4 ICMP unreachable

David Ryan David.Ryan at ...13912...
Tue Jun 5 06:17:14 EDT 2007


Thanks for the reply.  It was indeed a firewall issue - the device I was scanning was sending ICMP Host Administratively Unreachable packets when I tried certain scans, so I was seeing those packets.  As per the detail below I wasn't seeing the original traffic because of a problem with the _NET definitions.


-----Original Message-----
From: Todd Wease [mailto:twease at ...1935...]
Sent: 30 May 2007 13:15
To: David Ryan
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Everything being triggered as 1:486:4 ICMP unreachable

David Ryan wrote:
> All,
> To partly reply to my own question - one of my flaws was keeping
> $HOME_NET as - this prevented most of my test traffic from
> triggering since my tests were coming from $HOME_NET and not
> $EXTERNAL_NET.  This was significant where the rule I was testing was
> of the form $EXTERNAL_NET -> $HOME_NET

> David

Sounds like it might be a firewall issue.  This response is usually sent
by a firewall to say that it's filter won't allow communication with
that host/port.  It may be allowing ssh to that host (port 22) and may
be allowing pings, but not allowing the host/port combo used in your test.


**********************  IMPORTANT--PLEASE READ  ************************
This electronic message, including its attachments, is COMPANY CONFIDENTIAL
and may contain PROPRIETARY or LEGALLY PRIVILEGED information.  If you are 
not the intended recipient, you are hereby notified that any use, disclosure,
copying, or distribution of this message or any of the information included
in it is unauthorized and strictly prohibited.  If you have received this
message in error, please immediately notify the sender by reply e-mail and
permanently delete this message and its attachments, along with any copies
thereof. If this electronic message contains a zipped attachment and you do
not have a decompression tool, you may download unZIP (free of cost) from:
http://www.mk-net-work.com/us/uz/unzip.htm. Alternatively, you may request
that the attachment be resent in an uncompressed format.        Thank you. 

More information about the Snort-users mailing list