[Snort-users] BAD-TRAFFIC same SRC/DST

Dan Horne dan at ...12694...
Mon Nov 22 07:25:11 EST 2004


I just got snort/acid set up on my Win2K server, and I let it run for about
a week.  I am seeing thousands of these "BAD-TRAFFIC same SRC/DST" coming
from a single server on ports 67, 68 and 138.  It is a Win2K Domain
controller, as well as an RIS server.  I am at a loss to explain this
activity.  Can anyone help?

Dan Horne
Web Services Administrator
TAIS Web








More information about the Snort-users mailing list