Re: same SRC/DST

[Kyle R Maxwell <kylemaxwell () yahoo com>]

Looks like a Land attack (Google for land.c). You probably want to
watch for the whole packet to get the MAC addresses and make sure that
such an attack is not being launched from one of your (possibly
compromised) machines.


--- James <the_saint_james () yahoo com> wrote:
> 12/24-13:38:42.005838  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1452 -> 3.0.0.2:5103
> 12/24-13:38:45.105850  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1452 -> 3.0.0.2:5103
> 12/24-13:38:50.995873  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1452 -> 3.0.0.2:5103
> 12/24-13:39:05.195928  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1452 -> 3.0.0.2:5103
> 12/24-13:39:27.496015  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1454 -> 3.0.0.2:5103
> 12/24-13:39:30.496026  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1454 -> 3.0.0.2:5103
>
> I am sniffing the Ethernet interface of our DS3 gateway, so it either
> went
> in or out. This network, 3.0.0.0 (General Electric Company) is not
> part of
> our address space. Can anyone give me more info other than saying it
> is
> spoofing ? Sorry, no full headers.
>
> james
>
>
>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


=====
Kyle Maxwell [kylemaxwell () yahoo com]
"That that is is that that is not is not."

__________________________________________________
Do You Yahoo!?
Send your FREE holiday greetings online!
http://greetings.yahoo.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users