MISC loopback traffic

[Jim Rauser <jrauser () bepc com>]

has anyone seen this before
these are coming off a catalyst 4006 ME1 interface
I get five of these on boot
strange mac addresses

[**] [1:528:1] MISC loopback traffic [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
10/08-13:48:36.629261 FE:ED:FA:CE:FE:ED -> DE:AD:BE:EF:DE:AD type:0x800
len:0x3C
127.39.68.188 <../../../127/39/68/src127.39.68.188.html> -> 51.76.232.210
<../../../51/76/232/dest51.76.232.210.html> FIRE TTL:235 TOS:0x64 ID:8225
IpLen:20 DgmLen:55588 RB DF MF
Frag Offset: 0x1F94 Frag Size: 0x1A [**] [1:528:1] MISC loopback traffic
[**]
[Classification: Potentially Bad Traffic] [Priority: 2]
10/09-08:27:14.759261 FE:ED:FA:CE:FE:ED -> DE:AD:BE:EF:DE:AD type:0x800
len:0x3C
127.39.68.188 <../../../127/39/68/src127.39.68.188.html> -> 51.76.232.210
<../../../51/76/232/dest51.76.232.210.html> FIRE TTL:235 TOS:0x64 ID:8225
IpLen:20 DgmLen:55588 RB DF MF

jim



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users