Hi. I recently installed snort. I have been noticing allot of
Jan 6 11:40:00 fearthecow snort: [1:527:4] BAD-TRAFFIC same SRC/DST
[Classification: Potentially Bad Traffic] [Priority: 2]: {UDP}
127.0.0.1:53 -> 127.0.0.1:32966
Jan 6 11:40:00 fearthecow snort: [1:527:4] BAD-TRAFFIC same SRC/DST
[Classification: Potentially Bad Traffic] [Priority: 2]: {UDP}
127.0.0.1:32966 -> 127.0.0.1:53
Jan 6 11:40:00 fearthecow snort: [1:527:4] BAD-TRAFFIC same SRC/DST
[Classification: Potentially Bad Traffic] [Priority: 2]: {UDP}
127.0.0.1:53 -> 127.0.0.1:32966
Jan 6 11:40:00 fearthecow snort: [1:527:4] BAD-TRAFFIC same SRC/DST
[Classification: Potentially Bad Traffic] [Priority: 2]: {UDP}
127.0.0.1:32966 -> 127.0.0.1:53
Jan 6 11:40:00 fearthecow snort: [1:527:4] BAD-TRAFFIC same SRC/DST
[Classification: Potentially Bad Traffic] [Priority: 2]: {UDP}
127.0.0.1:53 -> 127.0.0.1:32966 -------**** this port will increment
This seems to keep happening on my loopback interface. I am not sure
what would be causing this. But it is certainly filling the logs up
quick. Any sugestions or comments would be greatly appreciated.
--
[EMAIL PROTECTED] mailing list
