Re: Snort ICMP

[Jose Maria Lopez <jkerouac () bgsec com>]

El mar, 21 de 12 de 2004 a las 13:56, Renata Adriana Gazzi escribió:
> Hi there!
> Me again! Please, someone knows why my snort only logs ICMP packets at the alert
> file? Is it anything misssing at the snort.conf or something like?
> Thanks!
> Renata

It can be a variety of causes:

1) Your rules or your config file it's wrong and your snort it's
only loading the ICMP rules.
2) You have a firewall or some kind of redirector that it's
redirecting or stopping the traffic from reaching the snort box.
3) Your HOME_NET or EXTERNAL_NET variables are wrong and you
are only receiving ICMP response traffic.
4) Your routing it's wrong and as in point 3 you are only
receiving ICMP response traffic.
5) The order that runs snort have some kind of tpcdump like
filter and it's not seeing any traffic.
6) If you are using a switch maybe it's not mirroring the
ports correctly. You can see this easily with ethereal.
7) Other causes I can't imagine now. Sorry.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac () bgsec com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users