Greets all, I have a question regarding some ICMP packets I've recorded. Here is the iptables log entry: May 2 13:07:45 gw1 kernel: DROP_INPUT IN=eth0 OUT= MAC=00:e0:29:85:f0:b0:00:00:0c:84:63:04:08:00 SRC=143.248.4.1 DST=64.179.20.65 LEN=56 TOS=0x00 PREC=0xC0 TTL=236 ID=18683 PRO TO=ICMP TYPE=11 CODE=0 [SRC=64.179.20.65 DST=200.223.0.232 LEN=40 TOS=0x00 PREC=0x00 TTL=0 ID=15436 PROTO=TCP INCOMPLETE [8 bytes] ] and here is the Snort decode: [**] ICMP Time-To-Live Exceeded in Transit (Undefined Code!) [**] 05/02-13:07:45.122521 143.248.4.1 -> 64.179.20.65 ICMP TTL:236 TOS:0xC0 ID:18683 IpLen:20 DgmLen:56 Type:11 Code:0 TTL EXCEEDED IN TRANSIT 00 00 00 00 45 00 00 28 3C 4C 00 00 00 06 5F C9 ....E..(<L...._. 40 B3 14 41 C8 DF 00 E8 1C 75 1A AE 1D E1 7F A8 @..A.....u...... =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ My question is regarding the decode of the alleged TCP packet (I say alleged as it was spoofed. I think this is a covert zombie communication channel) that generated the ICMP error. What exactly does "incomplete" mean? Does this simply mean that only 8 bytes of the 20 were present for decoding? If so, why do only certain type 11's get labeled as "incomplete"? iptables used to decode the original source and destination ports as part of the log entry. Has this feature gone away? Thanks in advance for any help, Chris
