Re: icmp: is this real?

[Chris Green <cmg () sourcefire com>]

John Sage <jsage () finchhaven com> writes:

> Is this a _real_ icmp packet, or a ghost in the machine?
>
> Ths was in a portscan I got around midnight 03/30/02. It is in
> sequence with the IP ID ahead of it, and after..
>
> And it _didn't_ have the  Type: Code: ID: Seq:  data line as all other
> packets usually do..
>
> The DgmLen: is clearly bogus, unless snort is on crack..
>
> Oh yeah, snort 1.8.2 build 86, running on Linux 2.2.14.

Please upgrade to snort-stable off the downloads page on
www.snort.org.  That was fixed post 1.8.3

-- 
Chris Green <cmg () sourcefire com>
Don't use a big word where a diminutive one will suffice.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users