[Snort-users] Help with snort message

Ben Beeson bwbees0 at ...6436...
Sun Feb 29 23:44:01 EST 2004


Aloha list,

	I was looking through my logs today and I noticed a few messages like: 

Feb 29 20:18:15 router snort: [1:528:3] BAD TRAFFIC loopback traffic
[Classification: Potentially Bad Traffic] [Priority: 2]: {TCP}
127.0.0.1:80 -> my.router.outer.ip:1815

I have seen a few of these entries rather sporadically in my logs, but
not all seem to use the same port on "my.router.outer.ip"

My question is what would cause something like this?  This message is
from my router box which does not have a web server or anything like it
running.  Basically, this router box runs RH7.2 with secure shell and a
firewall so I am wondering why anything would be looking at the
localhost port 80.   

	Any help anyone could offer that might enlighten me as to where or
whether I need to look would be greatly appreciated.  

Thanks in advance,

Ben 





More information about the Snort-users mailing list