Snort mailing list archives
Everything being triggered as 1:486:4 ICMP unreachable
From: David Ryan <David.Ryan () Quintiles com>
Date: Wed, 30 May 2007 06:10:10 -0400
Hi all, I built and tested a number of machines and shipped them out to remote sites recently. Now that they are at the remote site I am trying to tweak them a bit but I have run into some pretty basic problems that I hadn't come across before. I'm sure the devices were logging events properly before I shipped them, but now every time I try to test a rule I get back the following line - May 30 10:35:14 <hostname> snort[5017]: [1:486:4] ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited [Classification: Misc activity] [Priority: 3]: {ICMP} <probe address> -> <my test machine address> There are a couple of relevant points here - $HOME_NET is defined as 10.0.0.0/8 and $EXTERNAL_NET is defined as !$HOME_NET The probe has an ip address assigned in a /24 10.x.x subnet My test machine has an ip address assigned in a different /23 10.x.x subnet I know there is no routing problem since I am SSH'd in to the probe from my test machine and I can ping in both directions I am trying to read through the rule generating this message to see what is being triggered, but it looks pretty much like it is triggered on what it describes - an ICMP destination unreachable notification packet. I looked back through the old logs and see the following from before I shipped it off so I know it was logging correctly - May 15 12:08:10 <hostname> snort[2331]: [1:2189:3] BAD-TRAFFIC IP Proto 103 PIM [Classification: Detection of a non-standard protocol or event] [Priority: 2]: {PIM} <old probe address> -> 224.0.0.13 The only thing that changed is the probe IP address, but both the old and new configs used DHCP and I'm pretty sure that when I was testing before the IP address changed and it still continued to log OK. Any ideas what is causing this trigger ? As above, I am reasonably sure that it is not an actual ICMP destination unreachable packet because the destination is reachable . . . David ********************** IMPORTANT--PLEASE READ ************************ This electronic message, including its attachments, is COMPANY CONFIDENTIAL and may contain PROPRIETARY or LEGALLY PRIVILEGED information. If you are not the intended recipient, you are hereby notified that any use, disclosure, copying, or distribution of this message or any of the information included in it is unauthorized and strictly prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and permanently delete this message and its attachments, along with any copies thereof. If this electronic message contains a zipped attachment and you do not have a decompression tool, you may download unZIP (free of cost) from: http://www.mk-net-work.com/us/uz/unzip.htm. Alternatively, you may request that the attachment be resent in an uncompressed format. Thank you. ************************************************************************
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Everything being triggered as 1:486:4 ICMP unreachable David Ryan (May 30)