450.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--
Sid:
450

--
Summary:
This event is generated when an ICMP "Time Exceeded" message is generated that has an invalid ICMP code.  

--
Impact:
Informational.  This may indicate that the ICMP message has been crafted.

--
Detailed Information:
An ICMP "Time Exceeded" message is issued when either the maximum number of hops has been exceeded or a timer has expired before all fragments have been received.  The ICMP code value for this message should be 0 or 1.  If a value of greater than 1 for the ICMP code is observed, it may be an indication that the packet was crafted with an invalid value.

--
Affected Systems:
This traffic should have no adverse impact.

--
Attack Scenarios:
An attacker may craft an ICMP "Time Exceeded" message with an invalid ICMP code.  A single packet itself is not harmful, but the unusual ICMP code may indicate that this packet was abnormally generated.

--
Ease of Attack:
Simple. There are many packages available to generate ICMP messages.

--
False Positives:
Although rare, it is possible to observe an ICMP "Time Exceeded" message with an ICMP code greater than 1 if it is generated by software that does not conform to standards.

--
False Negatives:
None Known.

--
Corrective Action:
If a host or device in your network is generating this message, investigate why it does not have a standard ICMP code.

--
Contributors:
Original rule writer unknown.
Sourcefire Research Team
Judy Novak <[e-mail]>

--
Additional References:

--