[Snort-users] Same SRC/DST 127.0.0.1

Derrenbacker, L. Jonathan JDerrenbacker at ...10530...
Tue Nov 11 06:11:16 EST 2003


I'm getting tons of "BAD-TRAFFIC same SRC/DST" messages. 

The really weird thing is they're going to and from 127.0.0.1 on
different ports. It looks like sometimes port 631 is the destination and
sometimes the source. 

Right now there are only 2 boxes on the hub. I did a 'netstat -an' on
both, and it's the linux box that has the 127.0.0.1:631 open.

Any ideas of what this is?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20031111/97b43471/attachment.html>


More information about the Snort-users mailing list