Re: [Snort-users] tippingpoint]

Then we wouldn't see them. Of course, that would be a new generation of worm and
a new signature could be written. We would then need to make the same decision
of where we care about ICMP echo requests with 0xee[62] in the payload.

But this is an old discussion,


Geof

Michael Sierchio wrote:
> Geoff wrote:
>
> > ... We also dropped ICMP Welchia
>
>> packets, they consist of an echo request with 64 A's. ...
>
>
> There seems to be more than one source of packets with
> 0xaa in the ICMP payload. And what is it that generates
> ICMP echo requests with 0x45 ('E') as the payload?
>
> Tak,
>
> kudzu
>



-------------------------------------------------------
This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo
The Event For Linux Datacenter Solutions & Strategies in The Enterprise
Linux in the Boardroom; in the Front Office; & in the Server Room
http://www.enterpriselinuxforum.com
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users