Strange Loopback Traffic

["Chad Gross - Loretel" <cgross () loretel net>]

I have a single snort host with dual nics, one monitoring internal
traffic, one monitoring external traffic (setup in stealth mode). I
consistently see this traffic:
 
BAD-TRAFFIC loopback traffic    127.0.0.1:80     W.X.Y.Z:1969
BAD-TRAFFIC loopback traffic    127.0.0.1:80     W.X.Y.Z:1369
BAD-TRAFFIC loopback traffic    127.0.0.1:80     W.X.Y.Z:1177
.
.
.
 
W.X.Y.Z is the external address of the firewall, which has anti-spoofing
enabled. Sometimes the dest IP is from another IP on the subnet, but
more often it is the ext firewall IP.
 
Any ideas?
 
Chad