Snort mailing list archives
Re: MISC loopback traffic
From: Brian Caswell <bmc () mitre org>
Date: Mon, 23 Jul 2001 07:46:32 -0400
On Mon, Jul 23, 2001 at 01:23:10PM +0200, Francois Baligant wrote:
Given my investigation, I think those packet are generated by the Snort box itself.. If you ping 127.11.31.241, the loopback interface will answers. So it might be response packets trigered maybe by a packet received from source->127.0.0.0/8
While that may be true, you should still have cause for alarm. Loopback traffic is not supposed to be on the wire. If snort saw it on any interface other than loopback, you have issues. (Hence the signature for 127/8 :P) -brian _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- MISC loopback traffic Francois Baligant (Jul 20)
- Re: MISC loopback traffic Brian Caswell (Jul 20)
- Re: MISC loopback traffic Phil Wood (Jul 20)
- Re: MISC loopback traffic Francois Baligant (Jul 23)
- Re: MISC loopback traffic Brian Caswell (Jul 23)
- Re: MISC loopback traffic Phil Wood (Jul 20)
- Re: MISC loopback traffic Brian Caswell (Jul 20)
- <Possible follow-ups>
- Misc loopback traffic Michael J. Barillier (Aug 31)
- Re: Misc loopback traffic J. C. Woods (Aug 31)