[Snort-sigs] RESERVED IP and Broadcast address

Peter Millington peter_millington at ...621...
Wed Aug 6 02:01:03 EDT 2003


I am using SNORT as included in IPCop 1.3, and noticed some broadcast address packets arriving from the internet 

udp
from: 10.123.192.1:67
to: 255.255.255.255:68

This appears to be a broadcast from 10.x.x.x (a reserved address) looking for a BOOTP host !

I am a newcomer at Snort, so would appreciate some feedback/assistance:

Does anyone have a good set of rules for alerting/stopping [unwanted] broadcasts from a RED interface which don't make any sense?  Bearing in mind that I need to retain DHCP ip address acquisition.

Does anyone have a set of SNORT rules to alerting/stopping illegal/reserved IP addresses at a RED interface?

Thanks in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20030806/17f90b9d/attachment.html>


More information about the Snort-sigs mailing list