[Snort-users] Re: Snort-users digest, Vol 1 #1338 - 12 msgs
joe at ...3851...
Tue Nov 27 08:20:15 EST 2001
Thanks for the feedback Ryan. I don't think it explains what I've got going on, but it's good to know all the same!
Still getting port 0 to port 0 attempts, probably 100-200 a day against random IP's on my LAN. Wierd stuff.
>> 5. RE: Re: port 0 packets from bogon networks (Ryan Hill)
From: Ryan Hill <rhill at ...2446...>
To: 'Joe Pampel' <joe at ...3851...>
Cc: "Snort Mailing List (E-mail)" <snort-users at lists.sourceforge.net>
Subject: RE: [Snort-users] Re: port 0 packets from bogon networks
Date: Sun, 25 Nov 2001 20:04:03 -0800
FYI - although I haven't been seeing these packets externally, false alarms
on an internal sensor here have been traced to Cisco's Local Director boxes
and their communication with a management station. Bad Cisco - no biscuit!
Ryan Hill, MCSE
Corporate Information Systems
Telecommunication Systems, Inc. (TCS) - http://www.telecomsys.com
v: 206.792.2276 - f: 206.792.2001
More information about the Snort-users