0

My Snort alert output is like below. The first element of 4th row of each alert indicates Protocol. However, in the alert (portscan) TCP Portscan, the protocol is PROTO:255. What does it mean?

Why Portscan use PROTO:255 instead of TCP ?

Thanks

...

[**] [1:10001:1] Possible TCP DoS [**]
[Classification: DoS was detected] [Priority: 1] 
07/20-21:10:29.392535 172.16.116.44:10331 -> 198.199.206.217:80
TCP TTL:63 TOS:0x0 ID:35766 IpLen:20 DgmLen:44
******S* Seq: 0xC8A50927  Ack: 0x0  Win: 0x200  TcpLen: 24
TCP Options (1) => MSS: 1460 

[**] [122:1:1] (portscan) TCP Portscan [**]
[Classification: Attempted Information Leak] [Priority: 2] 
07/20-21:51:21.251815 207.136.86.223 -> 172.16.114.50
PROTO:255 TTL:254 TOS:0x0 ID:28488 IpLen:20 DgmLen:160

[**] [1:648:7] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
07/20-23:51:08.158403 172.16.114.148:20 -> 194.27.251.21:26637
TCP TTL:63 TOS:0x8 ID:61880 IpLen:20 DgmLen:1500
***A**** Seq: 0xC8C20948  Ack: 0xF05AC8A1  Win: 0x7D78  TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS181]

...
Improve this question

1 Answer 1

Reset to default
2

The one byte wide protocol field in the IPv4 header has all of its bits set. This doesn't mean anything in particular as IANA (Internet Assigned Numbers Authority) hasn't assigned that protocol number. Refer to the Protocol Numbers page on IANA's web site for more information. The packet may have been sent in an attempt to elicit an ICMP protocol unreachable message from the target network which could be analyzed by the scanning party, i.e. to check for data leakage or fingerprint the IP stack that generated the ICMP datagram.

Improve this answer
2
  • If so, is this TCP Portscan a kind of TCP protocol or ICMP protocol ? Because i see no src port and dst port from the alert
    – Hoang-Viet Nguyen
    Jun 15, 2017 at 13:03
  • No, it's just a malformed packet that is trying to provoke a failure or error. By definition, malformed packets do not have to comply with known protocols.
    – D.H.
    Aug 14, 2017 at 11:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .