I am new to Snort, and I have ran Snort through a
.cap file and got the logs that I should interpret. If I take for instance a block of log like the one below:
[**] [1:2463:7] EXPLOIT IGMP IGAP message overflow attempt [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] 05/29-19:44:02.238185 249.94.153.251 -> 249.94.153.77 IGMP TTL:255 TOS:0x0 ID:9744 IpLen:20 DgmLen:502 MF Frag Offset: 0x1FFF Frag Size: 0x01E2 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0367][Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0176][Xref => http://www.securityfocus.com/bid/9952]
I know that this is an alert generated by GID=1 signature id 2363, revision 7 (if I'm not wrong; also that means a denial of service alert), but what does the other information mean?