Understanding Snort log

Question

I am new to Snort, and I have ran Snort through a .cap file and got the logs that I should interpret. If I take for instance a block of log like the one below:

[**] [1:2463:7] EXPLOIT IGMP IGAP message overflow attempt [**]
[Classification: Attempted Administrator Privilege Gain] [Priority: 1] 
05/29-19:44:02.238185 249.94.153.251 -> 249.94.153.77
IGMP TTL:255 TOS:0x0 ID:9744 IpLen:20 DgmLen:502 MF
Frag Offset: 0x1FFF   Frag Size: 0x01E2
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0367][Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0176][Xref => http://www.securityfocus.com/bid/9952]

I know that this is an alert generated by GID=1 signature id 2363, revision 7 (if I'm not wrong; also that means a denial of service alert), but what does the other information mean?

Answer 1

[1:2463:7]: Intrusion Signature
EXPLOIT IGMP IGAP message overflow attempt [Classification: Attempted Administrator Privilege Gain] [Priority: 1] 05/29-19:44:02.238185: message explaining the possible consequences of the the attack.

249.94.153.251: Source IP: this is the IP address where snort believes the attack come from.

249.94.153.77: The destination IP: this is the IP address of the attack target.

IGMP TTL:255 TOS:0x0 ID:9744 IpLen:20 DgmLen:502 MF Frag Offset: 0x1FFF Frag Size: 0x01E2: Basically, in this attack the attacker creates and sends a malformed IGAP packet, and if decoded by a vulnerable version of Ethereal/tethereal, can cause a buffer overflow and the subsequent execution of arbitrary code. So, this data describes information about the IGMP packet that triggered the alert. Like Time to Live (TTL) and Type of Service (TOS) for more information look at http://www.tcpipguide.com/free/t_IPDatagramGeneralFormat.htm

[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0367][Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0176][Xref => http://www.securityfocus.com/bid/9952]: these are additional links that provide more information about the vulnerability that make this attack possible. The Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities.

For other snort signatures look at https://www.snort.org/rule_docs/

I hope this will help to understand snort alerts