Home page logo

basics logo Security Basics mailing list archives

Re: pings
From: Rodrigo Ramos <rodrigo.ramos () triforsec com br>
Date: Thu, 30 Dec 2004 08:48:06 -0300


What kind of ICMP packets are those? Just echo "8"?
You may try to get these kind of information from another networks?

Best regards,
Rodrigo Ramos

On Wed, 2004-12-29 at 07:33, cc wrote:
Leif Ericksen sighed and wrote::
Overall I would not worry to much about ping packets noticed in your
firewall logs.  Yeah notice them and unless you are seeing hundreds to
thousands of packets not a big deal.  I am on a DHCP connection with my
ISP and I see various hits in my IDS from PING.  ping hits aer way to
common for most people to worry about.

Here's a bit of stats that might put things into a bit of
a perspective.

Since 18th Feb. 2004, up until now, I've had 188000+ alerts.
As it stands, 69% of these are ICMP packets.

In the past, when I first installed snort on the firewall,
most were TCP connects.  Now the majority is ICMPs.

So I'm a little bit perturbed by this...

Attachment: signature.asc
Description: This is a digitally signed message part

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]