[Snort-users] False positive

Philip Edwards phil.e at ...15568...
Wed May 16 07:08:34 EDT 2012



Hi,

I have recently installed snort on ubuntu and am just attempting to tune out the noise.
For some reason the BAD-TRAFFIC (same source and destination) rule is firing on DHCP broadcasts.

The source is 0.0.0.0 port 67 and the destination is 255.255.255.255 port 68.

Since the source and destination are different can anyone clue me in?

Thanks

Phil Edwards



More information about the Snort-users mailing list