Re: MISC loopback traffic

[Brian Caswell <bmc () mitre org>]

Francois Baligant wrote:
> [**] [1:528:1] MISC loopback traffic [**]
> [Classification: Potentially Bad Traffic] [Priority: 2]
> 07/20-18:27:01.878267 127.15.66.85 -> 213.177.139.210
> IP TTL:0 TOS:0x0 ID:20 IpLen:20 DgmLen:1500 MF
> Frag Offset: 0xB9   Frag Size: 0x2

Actually yes it should trigger.

According to IANA, 127.0.0.0/8 is reserved for LOOPBACK.  You should
not see this on your network.

http://www.iana.org/assignments/ipv4-address-space

I plan on adding the other reserved IP address blocks as well
(0.0.0.0/8 for example) but I have not got around to doing that yet. 
Soon young jedi.

-- 
Brian Caswell
The MITRE Corporation

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users