[Silicon Defense logo]

SnortSnarf alert page

Source: 192.168.1.101

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

6 such alerts found using input module SnortFileInput, with sources:
Earliest: 21:22:00.213975 on 05/11/2003
Latest: 08:07:52.401755 on 05/12/2003

1 different signatures are present for 192.168.1.101 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

192.168.1.101 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade
See also 192.168.1.101 as an alert destination [951 alerts]

[**] [1:466:1] ICMP L3retriever Ping [**]
[Classification: Attempted Information Leak] [Priority: 2]
05/11-21:22:00.213975 192.168.1.101 -> 192.168.1.2
ICMP TTL:32 TOS:0x0 ID:9692 IpLen:20 DgmLen:60
Type:8 Code:0 ID:512 Seq:15360 ECHO
[Xref => http://www.whitehats.com/info/IDS311]
[**] [1:466:1] ICMP L3retriever Ping [**]
[Classification: Attempted Information Leak] [Priority: 2]
05/11-21:22:02.380477 192.168.1.101 -> 192.168.1.2
ICMP TTL:32 TOS:0x0 ID:9695 IpLen:20 DgmLen:60
Type:8 Code:0 ID:512 Seq:15616 ECHO
[Xref => http://www.whitehats.com/info/IDS311]
[**] [1:466:1] ICMP L3retriever Ping [**]
[Classification: Attempted Information Leak] [Priority: 2]
05/11-21:22:04.881418 192.168.1.101 -> 192.168.1.2
ICMP TTL:32 TOS:0x0 ID:9700 IpLen:20 DgmLen:60
Type:8 Code:0 ID:512 Seq:15872 ECHO
[Xref => http://www.whitehats.com/info/IDS311]
[**] [1:466:1] ICMP L3retriever Ping [**]
[Classification: Attempted Information Leak] [Priority: 2]
05/11-21:22:07.380741 192.168.1.101 -> 192.168.1.2
ICMP TTL:32 TOS:0x0 ID:9705 IpLen:20 DgmLen:60
Type:8 Code:0 ID:512 Seq:16128 ECHO
[Xref => http://www.whitehats.com/info/IDS311]
[**] [1:466:1] ICMP L3retriever Ping [**]
[Classification: Attempted Information Leak] [Priority: 2]
05/12-08:07:52.400579 192.168.1.101 -> 192.168.1.2
ICMP TTL:32 TOS:0x0 ID:56326 IpLen:20 DgmLen:60
Type:8 Code:0 ID:512 Seq:46592 ECHO
[Xref => http://www.whitehats.com/info/IDS311]
[**] [1:466:1] ICMP L3retriever Ping [**]
[Classification: Attempted Information Leak] [Priority: 2]
05/12-08:07:52.401755 192.168.1.101 -> 192.168.1.2
ICMP TTL:32 TOS:0x0 ID:56328 IpLen:20 DgmLen:60
Type:8 Code:0 ID:512 Seq:46848 ECHO
[Xref => http://www.whitehats.com/info/IDS311]
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:28 2003