[Snort-users] *NIX ping alerts

Jason Gauthier jgauthier at ...6155...
Mon Jun 24 13:56:02 EDT 2002

I'll give that a try. Thanks.

> Not sure how a NAT'd packet from a single monitoring node could have one
of 256 addresses.  
>Sounds fishy...

Because my firewall has a pool of public addresses it gives to an outbound
It translates between them:

Note, these IP addresses are fake.

Public                   Private
------                   --------    =>

This only holds in the xlate table for 5 minutes. When it connects the next
time it could be:

Public                   Private
------                   --------    =>

So, really, not 256 addresses, my pool is like 90.

More information about the Snort-users mailing list