[Snort-users] Bad-Traffic message....

hchlai at ...2792... hchlai at ...2792...
Mon May 8 12:03:05 EDT 2006

I have seen this coming from voice and video conferencing devices. You 
may need to contact the vendor to find out why the device is doing it, 
but most of the time, they are just harmless traffic of proprietary 
protocols which don't complying with RFC standards.


 -----Original Message-----
 From: Jeffery Gunter <jgunter at ...13738...>
 To: snort-users at lists.sourceforge.net
 Sent: Mon, 8 May 2006 11:33:01 -0400
 Subject: [Snort-users] Bad-Traffic message....

 Does anyone know how I can find out what this is and why? I'm getting
 about 30 messages a day on it and I can't figure out where it's coming

 Jeffery Gunter | Chief Information Officer | Citizens Bank of East
 Tennessee | http://www.cbetn.com
 email: jgunter at ...13738...
 Land: 423-272-2200 x17
 Cell: 423-754-5157
 Fax: 423-272-2322
 -----Original Message-----
 From: IDS [mailto:SNORT]
 Sent: Monday, May 08, 2006 11:30 AM
 To: Jeffery Gunter; 4237545157 at ...10251...
 Importance: Low

 IDS:S=snort:ID=1:[1:527:8] BAD-TRAFFIC same SRC/DST [Classification:
 Potentially Bad Traffic] [Priority: 2]: {UDP} ->
 :IDS:S=snort:ID=1:[1:527:8] BAD-TRAFFIC same SRC/DST [Classification:
 Potentially Bad Traffic] [Priority: 2]: {UDP} ->
 :IDS:S=snort:ID=1:[1:527:8] BAD-TRAFFIC same SRC/DST [Classification:
 Potentially Bad Traffic] [Priority: 2]: {UDP} ->

 This e-mail was scanned for viruses.

  Using Tomcat but need to do more? Need to support web services, 
  Get stuff done quickly with pre-integrated technology to make your job 
  Download IBM WebSphere Application Server v.1.0.1 based on Apache 
 Snort-users mailing list
 Snort-users at lists.sourceforge.net
 Go to this URL to change user options or unsubscribe:
 Snort-users list archive:

Try the New Netscape Mail Today!
Virtually Spam-Free | More Storage | Import Your Contact List

More information about the Snort-users mailing list