[Snort-users] Source IP 173.80.0.0

This is a multi-part message in MIME format.

----=_NextPart_000_000B_3528AF5E.999145E1
Content-type: text/plain; charset="US-ASCII"

Greetings -

Has anyone ran into seeing tons of traffic from this IP? I setup snort on my redhat box acting as
a my router for my cable modem. I see TONS of traffic from 173.80.0.0 to 0.0.0.0 The signature
lists as "snort\_decoder) WARNING: Not IPv4 datagram!", Layer 4 Protocol: 48

I've seen about 5000 packets in the past 8 hours. WHOIS informaion shows as being IANA Reserved...
http://ws.arin.net/cgi-bin/whois.pl?...put=173.80.0.0

Any ideas? Maybe the cable provider is using this as a broadcast for some dumb reason?

Thanks,
Ed


----=_NextPart_000_000B_3528AF5E.999145E1--



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users