Re: whats the meaning

[Fyodor <fygrave () tigerteam net>]

On Wed, Oct 17, 2001 at 07:47:14AM -0400, Greg Sarsons wrote:
> Just did a search and didn't see what I want so I'm asking
>
> I've got snort logging on a nic that doesn't have an IP address.  This
> am I just check syslog and saw a 5 or six entries from snort saying ICMP
> Unreachable IP short Header ( 1 bytes)

Very likely icmp unreach packet with corrupted fields. (not enough data
of original datagram or something). Some 'broken' ip stacks could
generate such. (read Ofir's paper for more details).

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users