Snort mailing list archives

Same SRC/DST 127.0.0.1


From: "Derrenbacker, L. Jonathan" <JDerrenbacker () KSHGS com>
Date: Mon, 10 Nov 2003 15:11:42 -0500

I'm getting tons of "BAD-TRAFFIC same SRC/DST" messages. 

The really weird thing is they're going to and from 127.0.0.1 on
different ports. It looks like sometimes port 631 is the destination and
sometimes the source. 

Right now there are only 2 boxes on the hub. I did a 'netstat -an' on
both, and it's the linux box that has the 127.0.0.1:631 open.

Any ideas of what this is?

Current thread: