-
snort warnings
I found these warnings in the snort reports:
Code:
Dec 2 17:04:42 gateway snort: [116:46:1] (snort_decoder) WARNING: TCP Data Offset is less than 5! {TCP} 210.95.x.y:0 -> 217.228.u.v:0
Dec 2 17:04:45 gateway snort: [116:46:1] (snort_decoder) WARNING: TCP Header length exceeds packet length! {TCP} 210.95.x.y:0 -> 217.228.u.v:0
Is someone able to explain ?
thx
-
It was doing sanity checking on the packet and found that it didn't add up. Possible that snort made a mistake, but more likely the person was trying to send specially crafted traffic (either heavily fragmenting to try to avoid IDS detection, or possibly to try to crash the TCP/IP stack on the victim machine).
/nebulus
-
Stanger:
This might help and you might want to read this too, It's not all to do with this alert but it is an interesting read.