[Snort-users] False positive

Philip Edwards phil.e at ...15568...
Wed May 16 07:08:34 EDT 2012


I have recently installed snort on ubuntu and am just attempting to tune out the noise.
For some reason the BAD-TRAFFIC (same source and destination) rule is firing on DHCP broadcasts.

The source is port 67 and the destination is port 68.

Since the source and destination are different can anyone clue me in?


Phil Edwards

More information about the Snort-users mailing list