You can find out a little more about ICMP Destination Unreachable here:
http://www.networksorcery.com/enp/protocol/icmp/msg3.htm
It could be caused by a number of things. For example there could be a
firewall (or router with ACLs) which is preventing a packet from being
received/forwarded and if the firewall had an option enabled to notify
the sender of this blocked port packet, then an ICMP type 3 code 3
packet would be sent out to the initiating IP addr from the firewall.
Bruce
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Chris W.
Parker
Sent: Monday, August 29, 2005 1:12 PM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] how to further diagnose 'ICMP Destination
Unreachable' problem?
Hello,
I have a lot of 'ICMP Destination Unreachable Port Unreachable' alerts
(36%) and I'm wondering what I should do to diagnose and correct the
problem.
I don't know much about networking so I wasn't able to glean much
insight from the Snort website
(http://www.snort.org/pub-bin/sigs.cgi?sid=402).
Any suggestions?
Thanks,
Chris.
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle
Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing &
QA
Security * Process Improvement & Measurement *
http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
