[Snort-users] question about ICMP echo reply (undefinted code) rule

[Rob Burris]

Snort is logging alerts when ICMP type 0 echo reply messages come back
in into my network. I'm okay with that as long as the echo request was
sent from my network. But I'm a little confused about the SID
description of this type of alert

"This event is generated when a network host generates an ICMP Echo
Reply with an invalid or undefined ICMP Code

http://www.snort.org/snort-db/sid.html?id=40

This snort rule is looking for a ICMP packet with itype:0

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Echo Reply
(Undefined Code!)"; itype: 0; sid:409; classtype:misc-activity; rev:4;

But isn't this type of ICMP message expected back from the machine that
is replying to the request

"ICMP Type 0 Code 0 is the RFC defined messaging type for ICMP Echo
Reply datagrams. This type of message is used to determine if a host is
active on the network.

I guess I'm not sure why it is considered invalid or undefined? Just
wondering..

- ro


------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program
Does SourceForge.net help you be more productive? Does i
help you create better code? SHARE THE LOVE, and help us hel
YOU! Click Here: http://sourceforge.net/donate
______________________________________________
Snort-users mailing lis
Snort-***@lists.sourceforge.ne
Go to this URL to change user options or unsubscribe
https://lists.sourceforge.net/lists/listinfo/snort-user
Snort-users list archive
http://www.geocrawler.com/redir-sf.php3?list=snort-user

[Matt Kettler]

Post by Rob Burris
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Echo Reply
(Undefined Code!)"; itype: 0; sid:409; classtype:misc-activity; rev:4;
But isn't this type of ICMP message expected back from the machine that is
replying to the request

Technically itype 0 icode 0 is expected. itype 0 with any other icode is not

This rule is really meant to be used in conjunction with SID 408... SID 408
picks up the ones with icmp type/code of 0/0, and then 409 picks up
everything else




------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program
Does SourceForge.net help you be more productive? Does i
help you create better code? SHARE THE LOVE, and help us hel
YOU! Click Here: http://sourceforge.net/donate
______________________________________________
Snort-users mailing lis
Snort-***@lists.sourceforge.ne
Go to this URL to change user options or unsubscribe
https://lists.sourceforge.net/lists/listinfo/snort-user
Snort-users list archive
http://www.geocrawler.com/redir-sf.php3?list=snort-user

[Rob Burris]

Post by Matt Kettler

Post by Rob Burris
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Echo Reply
(Undefined Code!)"; itype: 0; sid:409; classtype:misc-activity; rev:4;
But isn't this type of ICMP message expected back from the machine
that is replying to the request

Technically itype 0 icode 0 is expected. itype 0 with any other icode is not
This rule is really meant to be used in conjunction with SID 408...
SID 408 picks up the ones with icmp type/code of 0/0, and then 409
picks up everything else.

Ok that makes sense, but then shouldn't snort log the message with SID
408 instead of SID 409? If I ping yahoo.com snort logs the alert as SID
409. Why would yahoo.com reply with a invalid or undefined icmp message

|[**] ICMP Echo Reply (Undefined Code!)
<http://snort.keepthevibe.com/sig/sigsid-409.html> [**
2003-11-20:14:10:45 66.218.71.198
<http://snort.keepthevibe.com/66/218/71/src66.218.71.198.html> ->
10.0.1.1 <http://snort.keepthevibe.com/10/0/1/dest10.0.1.1.html
ICMP TTL:243 TOS:0 ID:48631 IpLen:5 DgmLen:8
Type:0 Code:0 ID: Seq:

- ro


------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program
Does SourceForge.net help you be more productive? Does i
help you create better code? SHARE THE LOVE, and help us hel
YOU! Click Here: http://sourceforge.net/donate
______________________________________________
Snort-users mailing lis
Snort-***@lists.sourceforge.ne
Go to this URL to change user options or unsubscribe
https://lists.sourceforge.net/lists/listinfo/snort-user
Snort-users list archive
http://www.geocrawler.com/redir-sf.php3?list=snort-user