Snort mailing list archives
RE: ICMP L3retriever Ping
From: "Jordan, Jason A" <Jason.Jordan () Honeywell com>
Date: Mon, 22 Dec 2003 05:27:34 -0700
It active directory related - if you have Win XP systems/and possibly win2000 as well, you will have these. You might want to examine your rule and/or look and see if the "computer browser" service is enabled on non-domain controllers (i.e. all the workstations, etc). Jason -----Original Message----- From: Özgüç Bayrak [mailto:ozguc.bayrak () eksen com] Sent: Monday, December 22, 2003 3:36 AM To: snort-users () lists sourceforge net Subject: [Snort-users] ICMP L3retriever Ping Hi, There are a lot of "ICMP L3retriever Ping" alerts in my snort logs. Does anyone know anything about this? (There isn't any symantec L3retriever scanner in my network.) Is that a trojan or a virus? Please help me. Thanks... ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ICMP L3retriever Ping Özgüç Bayrak (Dec 22)
- <Possible follow-ups>
- RE: ICMP L3retriever Ping Jordan, Jason A (Dec 22)