[Snort-users] Same SRC/DST 127.0.0.1

permalink · #1 (**permalink**) 11-11-2003

This is a multi-part message in MIME format.

------_=_NextPart_001_01C3A7C6.DB527957
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I'm getting tons of "BAD-TRAFFIC same SRC/DST" messages.=20

The really weird thing is they're going to and from 127.0.0.1 on
different ports. It looks like sometimes port 631 is the destination and
sometimes the source.=20

Right now there are only 2 boxes on the hub. I did a 'netstat -an' on
both, and it's the linux box that has the 127.0.0.1:631 open.

Any ideas of what this is?

------_=_NextPart_001_01C3A7C6.DB527957
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.0.6249.1">
<TITLE>Same SRC/DST 127.0.0.1</TITLE>
</HEAD>
<BODY>


I’m getting tons of =
“BAD-TRAFFIC same =
SRC/DST” messages. 

The =
really weird thing is they’re going to and from =
127.0.0.1 on different ports. It looks like sometimes port 631 is the =
destination and sometimes the source. =


Right =
now there are only 2 boxes on the hub. I did a =
‘netstat =
–an’ on both, =
and it’s the =
linux box that has the 127.0.0.1:631 =
open.

Any =
ideas of what this is?

</BODY>
</HTML>
------_=_NextPart_001_01C3A7C6.DB527957--

-------------------------------------------------------
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl, XML, Java, MySQL,
WebDAV, and more! http://www.apachecon.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode