Re: BAD TRAFFIC loopback traffic

[Edin Dizdarevic <edin.dizdarevic () interActive-Systems de>]

Hi,

could it be, that your're runng Snort with the "-i any" parameter?

Regards,

Edin

JP Vossen schrieb:
[...]
> > You had traffic from the loopback address 127.0.0.1 on the wire
> > (ethernet).  That should never happen.  Most likely the 127.0.0.1 address
> > was spoofed.
>
>
> FYIW, I had a similar issue.  I started getting a TON of this message in
> syslog:
[...]

--
Edin Dizdarevic



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users