[Snort-users] Fw: BAD TRAFFIC same SRC/DST

Saint James the_saint_james at ...131...
Tue Feb 12 00:09:07 EST 2002

 Grabbed  the MAC address on these,
>  it is not a local router for either. 

James here.....

I can see how this statement was confusing. I do
realize layer 2 is always local/LAN and does not
"follow" the IP. I've never seen my Snort box, my
office is 100 miles away from where it sniffs. Not
till I got out the network maps did I realize I was
assuming the wrong routers/MACS. Once I was looking in
the right place, the DST (MAC) resolves to the
Ethernet on the border router. That makes more sence. 

Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!

More information about the Snort-users mailing list