[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Large, constant incoming traffic

Il gio, 2004-05-13 alle 19:53, Kjetil Kjernsmo ha scritto:

> 19:41:32.083993 >  udp 376 [ttl 1]
> 19:41:32.192344 >  udp 376 [ttl 
> 1]

A switched lan, I see ;)
It can be slammer [1] (if so, I guess why the ISP tech is so busy :)
As you run snort, the eth is probably in promiscuous mode. I think this
is the reason you see ifconfig counter increasing (though the packets
aren't leading to your server). This and a non-switched lan, of course.

Gian Piero.


Reply to: