394.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--

Sid:
394

--

Summary:
This event is generated when an ICMP Destination Host Unknown datagram is detected on the network.  Gateway devices normally generate these ICMP messages when the destination's IP address is unreachable.

--

Impact:
This rule generates informational events about the network.  Large numbers of these messages on the network could indication routing problems or faulty routing devices.

--

Detailed Information:
This ICMP message will be generated when the destination host specified in the datagram is unreachable.

--

Attack Scenarios:
None Known

--

Ease of Attack:
Numerous tools and scripts can generate this type of ICMP datagrams.

--

False Positives:
None Known

--

False Negatives:
None Known

--

Corrective Action:
This rule detects informational network information, no correct action is necessary.

--

Contributors:
Original Rule writer unknown
Sourcefire Research Team
Matthew Watchinski ([e-mail])

--

Additional References:
None


--