457.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--
Sid:
457

--
Summary:
This event is generated when an ICMP type 14 is detected that does not 
include the necessary code in the packet.


--
Impact:

Can be used as a reconnaissance tool.  Traceroute reveals information
about the layout of a network.

--
Detailed Information:
There are at least three different implementations of traceroute.  In
one implementation traceroute works by sending an ICMP Echo Request
packet to a destination host with a TTL value of 1.  If the host is more
than one hop away, the first route that receives the back will send back
an ICMP packet indicating that the TTL was exceeded.  The address of
this router is then listed as the first hop.  The packet is then sent
out again with a TTL of 2.  This continues until the destination host is
able to reply or some maximum TTL value is reached.

The other two implementations use the same TTL-based concept with an
ICMP type of 30(traceroute) or with an UDP packet destined for an
ephemeral port.

--
Affected Systems:
All

--
Attack Scenarios:

Traceroute is often used against machines on a network prior to an
attack.

--
Ease of Attack:
Simple

--
False Positives:

--
False Negatives:
None known.

--
Corrective Action:
Block inbound ICMP type 30 messages.

--
Contributors:
Original Rule Writer Max Vision <[e-mail]>
Sourcefire Research Team
Judy Novak <[e-mail]>
Nigel Houghton <[e-mail]>
Snort documentation contributed by  by Steven Alexander<[e-mail]>

--
Additional References:

Miscellaneous
http://www.faqs.org/rfcs/rfc1393.html





--