[Snort-users] Re: Snort-users digest, Vol 1 #1338 - 12 msgs

Joe Pampel joe at ...3851...
Tue Nov 27 08:20:15 EST 2001


Thanks for the feedback Ryan.  I don't think it explains what I've got going on, but it's good to know all the same!
Still getting port 0 to port 0 attempts, probably 100-200 a day against random IP's on my LAN. Wierd stuff. 

Thanks,

Joe Pampel


>>   5. RE: Re: port 0 packets from bogon networks (Ryan Hill)
 
Message: 5
From: Ryan Hill <rhill at ...2446...>
To: 'Joe Pampel' <joe at ...3851...>
Cc: "Snort Mailing List (E-mail)" <snort-users at lists.sourceforge.net>
Subject: RE: [Snort-users] Re: port 0 packets from bogon networks
Date: Sun, 25 Nov 2001 20:04:03 -0800

Joe,

FYI - although I haven't been seeing these packets externally, false alarms
on an internal sensor here have been traced to Cisco's Local Director boxes
and their communication with a management station. Bad Cisco - no biscuit!

Regards,

Ryan Hill, MCSE 
IT Ninja
Corporate Information Systems
Telecommunication Systems, Inc. (TCS) - http://www.telecomsys.com 
v: 206.792.2276 - f: 206.792.2001
pgp: 0x17CE70AB







More information about the Snort-users mailing list