Snort mailing list archives
Broadcast address???
From: "Edward Marshall" <edtech () tstt net tt>
Date: Thu, 18 Sep 2003 05:59:43 -0400
Hi Guys, after running Snort 2.0.1 on a corporate network 192.168.2.0/24 for a week, I used Sawmill to analyze the Snort log files (Alert, Portscan.log and Scan.log). I noticed that the following source IP addresses showed up 192.168.2.255 (with 6,296 hits) and 255.255.255.255 (with 626 hits). My question is, isn't these two IP addresses - broadcast addresses??? How can a broadcast address show up as a source IP address??? Any assistance would be greatly appreciated!!! Thanks Eddie
Current thread:
- Broadcast address??? Edward Marshall (Sep 18)
