ICMP Redirect host

["Tony Wong" <tony.wong () stanford edu>]

I got a bunch of these in my alert log this morning:

04/16-07:21:31.684616  [**] [1:472:1] ICMP redirect host [**]
[Classification: Potentially Bad Traffic] [Priority: 2] {ICMP}
64.133.231.190 -> webserver
04/16-06:03:16.200708  [**] [1:499:1] MISC Large ICMP Packet [**]
[Classification: Potentially Bad Traffic] [Priority: 2] {ICMP}
130.126.25.180 -> webserver

Any idea what the attacker is doing?

Thanks


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users