OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: [snort] Anybody got a clue
From: Ralf Hildebrandt (R.Hildebrandttu-bs.de)
Date: Sun Mar 05 2000 - 06:26:39 CST

On Sat, Mar 04, 2000 at 05:16:44PM -0800, Max Vision wrote:
> In particular, I think it would be interesting if this fellow is not on
> the uoregon.edu network (shown as 'a'). So then you have traffic that is
> a --> b
> where your network is neither a nor b. That pretty much leaves spoofing
> from the local segment... If the packet came from outside his net, then
> how on earth did it get routed there?

Because the destination address was a multicast address and thus routed by
our University's router? 

-- 
Ralf Hildebrandt <R.Hildebrandttu-bs.de> www.stahl.bau.tu-bs.de/~hildeb
Sysadmins don't go to hell; we're already doing our time in purgatory.
  • application/pgp-signature attachment: stored