Is source address incorrect? Ipsec connections, firewalls with nat rules can cause this kind of issues.
Try dumping ossec traffic from manager and check that ip source is correct? Eero 7.4.2015 11.36 ip. "Sinisha Erceg" <ser...@windmobile.ca> kirjoitti: > Thanks Eero for your quick reply. I am aware of this and we only use > either a direct IP address or a subnet range. Would this still occur using > a subnet? We explicitly do not use ANY. I may have tested this on a box a > while back but it’s nothing that is currently being used for any of our > monitored hosts. > > > > > > *Sinisha Erceg* IT Security Analyst > > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
