392.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--

Sid:
392

--

Summary:
This event is generated when an ICMP Datagram Conversion Error message is detected on the network.  ICMP Datagram Conversion Error messages were developed with the introduction of IPv6 to give information about invalid datagram conversions between IPv4 and IPv6.

--

Impact:
No known attack vectors are known that use ICMP type 31 datagrams.  This is purely an informational message that detects errors on the network.

--

Detailed Information:
ICMP Type 31 was developed to return information about datagram conversion errors between IPv4 and IPv6 as data is converted between them.  

--

Attack Scenarios:
None known
--

Ease of Attack:
Numerous tools and scripts can generate ICMP Datagram Conversion Error messages.

--

False Positives:
None known

--

False Negatives:
None known

--

Corrective Action:
ICMP Type 31 datagrams should be blocked at the firewall.

--

Contributors:
Original Rule writer unknown
Sourcefire Research Team
Matthew Watchinski ([e-mail])

--

Additional References:
None


--