427.txt

来自「snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具」· 文本 代码 · 共 62 行

Rule:

--

Sid:
427

--

Summary:
This event is generated when a router generates and ICMP Parameter Problem Unspecified Error datagram.

--

Impact:
This could be an indication of a protocol error by a previous hop router.  Normally this datagram would only be generated with the datagram was truncated or damaged before it reached its final destination.

--

Detailed Information:
A router generates a Parameter Problem message for any error not specifically covered by another ICMP message.  This could be an indication of routing problems on the network, or malfunctioning routing hardware.

--

Attack Scenarios:
None known

--

Ease of Attack:
Numerous tools and scripts can generate this type of ICMP datagram.

--

False Positives:
None known

--

False Negatives:
None known

--

Corrective Action:
ICMP Type 12 Code 0 datagrams are not normal network activity.  Hosts generating these types of datagrams should be investigated for configuration errors or nefarious activity.

--

Contributors:
Original Rule writer unknown
Sourcefire Research Team
Matthew Watchinski ([e-mail])

--

Additional References:
None


--