[Snort-users] Broadcast address???

Edward Marshall edtech at ...9974...
Thu Sep 18 03:01:52 EDT 2003

Hi Guys, after running Snort 2.0.1 on a corporate network
for a week, I used Sawmill to analyze the Snort log files (Alert,
Portscan.log and Scan.log).
I noticed that the following source IP addresses showed up
(with 6,296 hits) and (with 626 hits). My question is,
isn't these two IP addresses - broadcast addresses???  How can a
broadcast address show up as a source IP address??? 
Any assistance would be greatly appreciated!!!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030918/69d9bac7/attachment.html>

More information about the Snort-users mailing list