Snort mailing list archives

Broadcast address???


From: "Edward Marshall" <edtech () tstt net tt>
Date: Thu, 18 Sep 2003 05:59:43 -0400

Hi Guys, after running Snort 2.0.1 on a corporate network 192.168.2.0/24
for a week, I used Sawmill to analyze the Snort log files (Alert,
Portscan.log and Scan.log).
I noticed that the following source IP addresses showed up 192.168.2.255
(with 6,296 hits) and 255.255.255.255 (with 626 hits). My question is,
isn't these two IP addresses - broadcast addresses???  How can a
broadcast address show up as a source IP address??? 
 
Any assistance would be greatly appreciated!!!
 
 
Thanks
 
Eddie
 
 

Current thread: