[Snort-users] False positive
phil.e at ...15568...
Wed May 16 07:08:34 EDT 2012
I have recently installed snort on ubuntu and am just attempting to tune out the noise.
For some reason the BAD-TRAFFIC (same source and destination) rule is firing on DHCP broadcasts.
The source is 0.0.0.0 port 67 and the destination is 255.255.255.255 port 68.
Since the source and destination are different can anyone clue me in?
More information about the Snort-users