[Snort-sigs] RESERVED IP and Broadcast address
peter_millington at ...621...
Wed Aug 6 02:01:03 EDT 2003
I am using SNORT as included in IPCop 1.3, and noticed some broadcast address packets arriving from the internet
This appears to be a broadcast from 10.x.x.x (a reserved address) looking for a BOOTP host !
I am a newcomer at Snort, so would appreciate some feedback/assistance:
Does anyone have a good set of rules for alerting/stopping [unwanted] broadcasts from a RED interface which don't make any sense? Bearing in mind that I need to retain DHCP ip address acquisition.
Does anyone have a set of SNORT rules to alerting/stopping illegal/reserved IP addresses at a RED interface?
Thanks in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-sigs