same SRC/DST

["James" <the_saint_james () yahoo com>]

12/24-13:38:42.005838  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
3.0.0.2:1452 -> 3.0.0.2:5103
12/24-13:38:45.105850  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
3.0.0.2:1452 -> 3.0.0.2:5103
12/24-13:38:50.995873  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
3.0.0.2:1452 -> 3.0.0.2:5103
12/24-13:39:05.195928  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
3.0.0.2:1452 -> 3.0.0.2:5103
12/24-13:39:27.496015  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
3.0.0.2:1454 -> 3.0.0.2:5103
12/24-13:39:30.496026  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
3.0.0.2:1454 -> 3.0.0.2:5103

I am sniffing the Ethernet interface of our DS3 gateway, so it either went
in or out. This network, 3.0.0.0 (General Electric Company) is not part of
our address space. Can anyone give me more info other than saying it is
spoofing ? Sorry, no full headers.

james





_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users