[Snort-users] Help with snort message

Aloha list,

I was looking through my logs today and I noticed a few messages like:

Feb 29 20:18:15 router snort: [1:528:3] BAD TRAFFIC loopback traffic
[Classification: Potentially Bad Traffic] [Priority: 2]: {TCP}
127.0.0.1:80 -> my.router.outer.ip:1815

I have seen a few of these entries rather sporadically in my logs, but
not all seem to use the same port on "my.router.outer.ip"

My question is what would cause something like this? This message is
from my router box which does not have a web server or anything like it
running. Basically, this router box runs RH7.2 with secure shell and a
firewall so I am wondering why anything would be looking at the
localhost port 80.

Any help anyone could offer that might enlighten me as to where or
whether I need to look would be greatly appreciated.

Thanks in advance,

Ben



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users