Re: [Snort-sigs] false positive on 1:469 ICMP PING NMAP

El jue, 14 de 10 de 2004 a las 15:59, Nigel Houghton escribiÃ:

> In the false positive section for the rule it states:
>
> "The only current identifying feature of nmap's ICMP ping is
> that the data size is 0.  It is entirely possible that other tools may
> send icmp pings with zero data."
>
> It would seem that your Alteon AD4 is one of those tools. Having said that,
> if your AD4 and your router are both in your home net and your $HOME_NET
> and $EXTERNAL_NET variables are set correctly, this rule should not
> generate an event.

Or if it's giving you real problems deactivate it, it does not
very useful anyway.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÃA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs