Snort mailing list archives
RE: ICMP Source Quench
From: "McCammon, Keith" <Keith.McCammon () eadvancemed com>
Date: Tue, 27 Aug 2002 09:23:52 -0400
Hard to say for sure without seeing the traffic that preceded (or followed) the SQ message. However, this generally means that 195.161.172.228 is experiencing congestion, and that 213.152.133.10 should reduce the amount of data that it is sending. Most TCP implementation will respond in a manner similar to that of a TCP window size reduction. While this can be sent in response to any protocol, SQ is generally associated with congestion control mechanisms in TCPs.
-----Original Message----- From: Sergei Balyakin [mailto:sergei () rsl ru] Sent: Tuesday, August 27, 2002 9:16 AM To: snort-users-request () lists sourceforge net Subject: [Snort-users] ICMP Source Quench Hi! Does anyone knows what it means. Too many messages last some days. Thankx in advance. [**] ICMP Source Quench [**] 08/26-11:26:25.412038 195.161.172.228 -> 213.152.133.10 ICMP TTL:247 TOS:0x0 ID:45317 IpLen:20 DgmLen:56 Type:4 Code:0 SOURCE QUENCH 00 00 00 00 45 00 05 DC 5F C5 40 00 36 06 27 DF ....E..._.@.6.'. D5 98 85 0A D9 6B 83 69 00 50 04 04 29 71 38 2C .....k.i.P..)q8, -- Best regards, Sergei mailto:sergei () rsl ru ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ICMP Source Quench Sergei Balyakin (Aug 27)
- <Possible follow-ups>
- RE: ICMP Source Quench Dan Fiorito (Aug 27)
- RE: ICMP Source Quench McCammon, Keith (Aug 27)
- RE: ICMP Source Quench Wirth, Jeff (Aug 27)
- RE: ICMP Source Quench McCammon, Keith (Aug 27)
- RE: ICMP Source Quench Ofir Arkin (Aug 28)
- Re: ICMP Source Quench Chris Keladis (Aug 28)
- RE: ICMP Source Quench Ofir Arkin (Aug 28)
- RE: ICMP Source Quench Ofir Arkin (Aug 28)
- RE: ICMP Source Quench Hicks, John (Sep 04)