MISC loopback traffic

[Francois Baligant <francois () be wanadoo com>]

[**] [1:528:1] MISC loopback traffic [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
07/20-18:27:01.878267 127.15.66.85 -> 213.177.139.210
IP TTL:0 TOS:0x0 ID:20 IpLen:20 DgmLen:1500 MF
Frag Offset: 0xB9   Frag Size: 0x2

alert ip any any <> 127.0.0.0/8 any (msg:"MISC loopback traffic";
classtype:bad-unknown; sid:528; rev:1;)

        this shoudln't trigger...

        I just updated to snortCVS.

        Francois

-- 

Francois Baligant            _     Wanadoo Belgium NV/SA,
Network Operation Center    ( )       a subsidiary of France Telecom
                            /_\/   Lozenberg 22 - B-1932 Zaventem
francois () be wanadoo com    (__/\   tel: +32 2 717 17 17
FB1-6BONE                          fax: +32 2 717 17 77

- "if you hold a unix shell to your ear, do you hear the c?"


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users