Snort mailing list archives
Strange PATH MTU Traffic
From: "Joshua Berry" <jberry () PENSON COM>
Date: Mon, 25 Apr 2005 10:56:44 -0500
I am getting this alert: ICMP PATH MTU denial of service I have never had this alert previous to this weekend, and have received 40,000 within the last 8 hours. Some of this traffic appears to be encrypted, the rest of it is hitting our domain controllers and contains schema information. I know Microsoft does some screwy stuff but I have never seen schema information transmitted in an ICMP packet, much less a path mtu discovery packet. Anyone else seen this type of traffic? Josh Berry | CISSP GCIA Information Security 214-765-1296 -------------------------------------------------------------------- If you spend more on coffee than on IT security, you will be hacked. What's more, you deserve to be hacked. -- (Former) White House Cybersecurity adviser Richard Clarke ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_ide95&alloc_id396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Strange PATH MTU Traffic Joshua Berry (Apr 26)
- <Possible follow-ups>
- RE: Strange PATH MTU Traffic larosa_vjay (Apr 26)
- RE: Strange PATH MTU Traffic larosa_vjay (Apr 26)