Embedded Fragment?

["Daniel Holden" <dholden () idsb net>]

Can someone tell me (or point me to the docs) what the following means?

Feb 19 21:52:52 crow kernel: ipt_unclean: (embedded packet) Embedded
fragment.
Feb 19 21:52:51 crow kernel: IN=eth0 OUT= MAC=uglyMacAddressHere
SRC=192.5.4.146 DST=209.142.39.160 LEN=56 TOS=0x00 PREC=0x00 TTL=245
ID=22342 DF PROTO=ICMP TYPE=3 CODE=13 [SRC=209.142.39.160 DST=204.152.187.2
LEN=64 TOS=0x00 PREC=0x00 TTL=55 ID=47316 FRAG:64 PROTO=TCP ]

Thank you
Daniel Holden
dholden () idsb net
http://www.idsb.net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users