[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-users
Subject:    Re: [Snort-users] same SRC/DST
From:       Ashley Thomas <athomas () unity ! ncsu ! edu>
Date:       2001-12-26 3:50:20
[Download RAW message or body]


- when src and dest ip are the same , it is generally called a LAND attack



On Mon, 24 Dec 2001, James wrote:

> 12/24-13:38:42.005838  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1452 -> 3.0.0.2:5103
> 12/24-13:38:45.105850  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1452 -> 3.0.0.2:5103
> 12/24-13:38:50.995873  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1452 -> 3.0.0.2:5103
> 12/24-13:39:05.195928  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1452 -> 3.0.0.2:5103
> 12/24-13:39:27.496015  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1454 -> 3.0.0.2:5103
> 12/24-13:39:30.496026  [**] [1:527:2] BAD TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 3.0.0.2:1454 -> 3.0.0.2:5103
>
> I am sniffing the Ethernet interface of our DS3 gateway, so it either went
> in or out. This network, 3.0.0.0 (General Electric Company) is not part of
> our address space. Can anyone give me more info other than saying it is
> spoofing ? Sorry, no full headers.
>
> james
>
>
>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>


_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
[prev in list] [next in list] [prev in thread] [next in thread]