Snort alerts of the ICMP relationship with smtp connection?

Discussion in 'other security issues & news' started by hacinn, Jun 6, 2005.

Thread Status:
Not open for further replies.
  1. hacinn

    hacinn Registered Member

    Joined:
    Jun 29, 2004
    Posts:
    6
    Hi,

    I am using Snort version Version 2.3.2 (Build 12).
    I have in my snort logs the alerts:

    366 - ICMP Ping *nix
    384 - ICMP Ping
    368 - Ping BSDtype

    I investigated my others systems logs and in the time
    that this alert is recorded is the same that
    registered smtp connection in the maillog arquive from
    my postfix server.

    The source IP address in snort's log is equal the
    destination IP address in the maillog to smtp
    connection.

    My smtp server is a Postfix version 1.1.3.

    This alerts can to be generated by destination mail server when
    it receives mails?

    Any friends have said about the path MTU discovery, it's true? How can i to confirm this?

    This alerts is a false positive?

    Thanks by help
     
Loading...
Thread Status:
Not open for further replies.