Re: Strange Loopback Traffic

[Frank Knobbe <frank () knobbe us>]

On Tue, 2003-10-07 at 21:57, Chad Gross - Loretel wrote:
> I have a single snort host with dual nics, one monitoring internal
> traffic, one monitoring external traffic (setup in stealth mode). I
> consistently see this traffic:
>  
> BAD-TRAFFIC loopback traffic    127.0.0.1:80     W.X.Y.Z:1969
> BAD-TRAFFIC loopback traffic    127.0.0.1:80     W.X.Y.Z:1369
> BAD-TRAFFIC loopback traffic    127.0.0.1:80     W.X.Y.Z:1177
> .
> .
> .
>  
> W.X.Y.Z is the external address of the firewall, which has
> anti-spoofing enabled. Sometimes the dest IP is from another IP on the
> subnet, but more often it is the ext firewall IP.
>  
> Any ideas?


No idea, but we've seen this too since last last week. It appears to be
spoofed packet coming in from the Internet.

Frank

Attachment: signature.asc
Description: This is a digitally signed message part