[Snort-users] a lot of Loopback traffic being logged.

Matt Kettler mkettler at ...4108...
Thu Apr 22 09:55:02 EDT 2004


At 09:38 AM 4/22/2004, Chuck Holley wrote:
>"BAD-TRAFFIC loopback traffic"  I am getting a lot of this one alert on 
>127.0.0.1.  im really not sure what is causing this.  If it is faulty 
>networking or maybe a spoofer.  Now that I know im getting this, thanks to 
>SNORT, what the heck do I do about it?  Anyone ever remedy this problem?

What interface parameter are you passing to snort on the command line? -i 
any? Try forcing snort to only listen on one real ethernet interface, it 
could be sniffing your loopback interface, which naturally would have 
loopback traffic on it.







More information about the Snort-users mailing list