[Snort-users] Logging Issue

John D. Caine john at ...7696...
Tue Dec 10 04:45:04 EST 2002


Hello,

    I've got Snort running and it's logging away quite happily. There is
something that makes me scratch my head though. How come it's catching stuff
thats not destined for my machine?

Here's a scan.log entry:

12/09-16:33:08.677905  ICMP src: 212.4.208.191 dst: 213.239.42.97 type: 8
code: 0 tgts: 8 event_id: 204

The dst IP isn't mine! Does Snort set your ethernet card to be
'promiscuous'? Even so I'm on a swicthed network. I'ts not just portscan
that does it it ops up in the normal log too. Does anybody know what causes
this or am I reading the logs incorrectly??

Thanks.

Regards, John.





More information about the Snort-users mailing list