Re: L3 Retriever Ping False Alarms

["netsec novice" <netsec9 () hotmail com>]

I get the same thing with XP proffesional hosts to a NT4 domain controller.  
I am also wondering why this traffic is occurring.





> From: "Parker, Ian" <parker.ian () syncrude com>
> To: "'snort-users () lists sourceforge net'" 
> <snort-users () lists sourceforge net>
> Subject: [Snort-users] L3 Retriever Ping False Alarms
> Date: Thu, 19 Dec 2002 16:17:38 -0700
>
> Does anybody what causes Win2K hosts to issue pings that look like L3
> Retriever Pings? When I do a regular ping, the payload is all zeros.
> However, something else in the system is sending pings with the
> characteristic L3 Retriever payload of "ABCDEFG...." etc.
>
> Ian Parker, GCWN
>
> Senior Systems Analyst
> Upgrading Plant Computing
> Syncrude Canada Ltd
>
> (780)790-4631
> parker.ian () syncrude com
>
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by: Geek Gift Procrastinating?
> Get the perfect geek gift now!  Before the Holidays pass you by.
> T H I N K G E E K . C O M      http://www.thinkgeek.com/sf/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_________________________________________________________________
Add photos to your messages with MSN 8. Get 2 months FREE*. 
http://join.msn.com/?page=features/featuredemail&xAPID=42&PS=47575&PI=7324&DI=7474&SU= 
http://www.hotmail.msn.com/cgi-bin/getmsg&HL=1216hotmailtaglines_addphotos_3mf



-------------------------------------------------------
This SF.NET email is sponsored by:  The Best Geek Holiday Gifts!
Time is running out!  Thinkgeek.com has the coolest gifts for
your favorite geek.   Let your fingers do the typing.   Visit Now.
T H I N K G E E K . C O M        http://www.thinkgeek.com/sf/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users