Re: MISC loopback traffic

[Brian Caswell <bmc () mitre org>]

On Mon, Jul 23, 2001 at 01:23:10PM +0200, Francois Baligant wrote:
>       Given my investigation, I think those packet are
>       generated by the Snort box itself..
>
>       If you ping 127.11.31.241, the loopback interface
>       will answers.
>
>       So it might be response packets trigered maybe
>       by a packet received from source->127.0.0.0/8

While that may be true, you should still have cause for alarm.  

Loopback traffic is not supposed to be on the wire.  If snort saw it
on any interface other than loopback, you have issues.  (Hence the 
signature for 127/8 :P)

-brian

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users