[asterisk-users] tired of "midget packet received" warnings

[Tzafrir Cohen]

On Sat, Nov 08, 2008 at 02:33:18PM +1100, Rob Hillis wrote:
> Tzafrir Cohen wrote:
> > On Fri, Nov 07, 2008 at 09:29:20AM +0000, Tim Panton wrote:
> >
> >   
> >> I'd take this warning seriously. It means that your monitoring app isn't
> >> monitoring what you think it is.
> >>
> >> I always want to know when I get malformed protocol packets in. It is
> >> always bad news, mostly either a misconfiguration (your case), an  
> >> attack,
> >> (ie my firewall is not protecting this service) or a sign of a switch  
> >> port going bad.
> >>
> >> Fix the cause not the symptom.
> >>     
> >
> > Maybe it's me, but I think that "warning" should be regarding a problem
> > I can fix. Malformed network content does not neceserily fall under that
> > definition. "notice"?
> >   
> 
> Absolutely it does.  Warnings of malformed packets are often (as 
> mentioned above) symptomatic of network problems.  Fix the network 
> problem, fix the warning.

As you saw in this case, this is a monitoring program that checks if
somebody still listens on the UDP port. Would you teach nmap to try a
valid IAX packet on every UDP port? How can you tell in advance that the
port is IAX and not SIP? Or whatever UDP protocol? Why should the
monitoring program care?

-- 
               Tzafrir Cohen
icq#16849755              jabber:tzafrir.cohen at xorcom.com
+972-50-7952406           mailto:tzafrir.cohen at xorcom.com
http://www.xorcom.com  iax:guest at local.xorcom.com/tzafrir