[Snort-users] Snort Glitch perhaps

From: Allan <adover(at)rogers.com>
Date: Thu Mar 06 2003 - 12:16:29 EST

Hey everyone,

I am using RH 8.0 with snort 1.9.1 and latest ACID. When I modified the rules, I decided to turn on the porn rule. I have 2 known users that surf when they shouldnt be "cest la vie".

What is interesting is when I log into the acid console from my home remote computer, it starts flagging alerts, when I look they are pron alerts coming from my snort box serving my home pc. I am sitting in fromnt of my snort box, and logging into acid console all is well, except I am seeing porn rules coming from an outside address to my networ broadcast.

Any Ideas ?

I can provide logs if anyone wants to see, the funny thing is, when i check the source ip one comes up as a search engine and so on.

Any insight or thoughts are greatly appreciated.

Allan

Allan Dover
adover@rogers.com

---

This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger for complex code. Debugging C/C++ programs can leave you feeling lost and disoriented. TotalView can help you find your way. Available on major UNIX and Linux platforms. Try it free. www.etnus.com

---

Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users Received on Thu Mar 6 12:42:05 2003