Security – snort: drop icmp rule doesn’t actually drop packets

Custom actions are defined by ruletype declarations in snort.conf; these custom actions can then be used in your rules. From the default snort.conf:

# You can optionally define new rule types and associate one or more output
# plugins specifically to that type.
#
# This example will create a type that will log to just tcpdump.
# ruletype suspicious
# {
#   type log
#   output log_tcpdump: suspicious.log
# }
#
# EXAMPLE RULE FOR SUSPICIOUS RULETYPE:
# suspicious tcp $HOME_NET any -> $HOME_NET 6667 (msg:"Internal IRC Server";)

Because ruletypes can be completely arbitrary, it makes more sense to parse the snort.conf file for any ruletypes defined first and then use that in your rule parser's action hash or whatever to match against.

I'd hazard a guess (hard to be sure without more investigation) that someone is spoofing your IP as a source and you're getting the return traffic.

Remember that tcpdump examines the "wire" (ie, BEFORE iptables) so you'll still see the traffic in tcpdump even if iptables is dropping the traffic.

You can't stop the packets coming to you (your provider needs to do that), all you can do is drop them to minimize the impact on your host.