Re: SUMMARY, CyberKit 2.2 Ping, its driven me Nuts..

[Jeff Kell <jeff-kell () utc edu>]

Brice B wrote:
 Chris,
>  would you mind telling us how you set it to alert only internal 
> Cyberkit/Nachi ping attempts? Did you use thresholding?

Can anyone verify the [non]existance of a difference between the 
Cyberkit and Nachi pings?  Not having Cyberkit myself, I can only
address Nachi.  The frame is 106 bytes on the wire, 92 bytes in the IP 
packet, and 64 bytes of 0xaa in the ICMP data payload.

If Cyberkit is anything but 64 bytes of 0xaa payload, perhaps a new, 
Nachi-specific rule is called for.

Jeff



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users