Snort mailing list archives
Unknown Datagram decoding problem!
From: <CGhercoias () TWEC COM>
Date: Wed, 8 Oct 2003 12:55:33 -0400
Hello,
Starting last night my snort system have started to record these alerts.
177.1.0.x is our proxy-gateway and from this machine all these alerts
are going all over the place in the network.
Someone have seen these before? Is some kind of new exploit out there?
------------------------------------------------------------------------
------
#(3 - 708725) [2003-10-08 10:09:50] [snort/108] (snort_decoder) Unknown
Datagram decoding problem!
IPv4: 177.1.0.x -> 177.1.0.y
hlen=5 TOS=0 dlen=32 ID=49536 flags=0 offset=0 TTL=128 chksum=5961
ICMP: type=Redirect code=1
checksum=191 id= seq=
Payload: length = 8
000 : B1 01 00 3E 45 00 04 00 ...>E...
------------------------------------------------------------------------
------
#(3 - 708578) [2003-10-08 09:51:07] [snort/108] (snort_decoder) Unknown
Datagram decoding problem!
IPv4: 177.1.0.x -> 177.1.0.y
hlen=5 TOS=0 dlen=33 ID=22713 flags=0 offset=0 TTL=128
chksum=32760
ICMP: type=Redirect code=1
checksum=36372 id= seq=
Payload: length = 9
000 : B1 01 01 E8 45 00 05 00 70 ....E...p
------------------------------------------------------------------------
------
#(3 - 708577) [2003-10-08 09:51:07] [snort/108] (snort_decoder) Unknown
Datagram decoding problem!
IPv4: 177.1.0.x -> 177.1.0.y
hlen=5 TOS=0 dlen=33 ID=22489 flags=0 offset=0 TTL=128
chksum=32984
ICMP: type=Redirect code=1
checksum=36372 id= seq=
Payload: length = 9
000 : B1 01 01 E8 45 00 05 00 70 ....E...p
Thank you in advance,
*-----------------------------------*
| Catalin Ghercoias |
| cghercoias () twec com
*------------------------------------------*
| http://www.fye.com | "Tart words make no friends; a
spoonful |
| | of honey will catch more
flies than |
| 518-452-1242 | a gallon of vinegar."
|
*--------------------------------| -- B. Franklin
|
|
|
*------------------------------------------*
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Unknown Datagram decoding problem! CGhercoias (Oct 08)
