OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: [Snort-users] a lot of Loopback traffic being logged.

Mark.SchutzmannOmron.com
Date: Thu Apr 22 2004 - 17:08:50 CDT

I reported this same problem earlier. I had a lot of great feedback, if you
want to search the mailing list. Recently, I had this come up again. I used
Snort in non-daemon mode to find the MAC address that was associated with
the 127.0.0.1 address, which lead me to a router (ugh!), I then had to
trace that through my WAN to another network, where we found the local MAC
and traced that to a couple of Japanese engineers who were visiting our
company and had plugged their computers into our network. Unfortunately,
because we did not have a translator and could not readily sift through
their Japanese OS computers, I still cannot say what the source program was
that caused this. I simply had to quarantine their computer away from the
corporate network. If I find a translator and the program, I will forward
this info on. Let me know what you find! I suspect some virus or trojan.
This is a fairly amateur attack to actually be running manually. Good Luck!

Best Regards,
Mark

                                                                                                                                                  
                      "Chuck Holley"
                      <cholleyfitnessquest.com> To: <snort-userslists.sourceforge.net>
                      Sent by: cc:
                      snort-users-adminlists.sour Subject: [Snort-users] a lot of Loopback traffic being logged.
                      ceforge.net
                                                                                                                                                  
                                                                                                                                                  
                      04/22/2004 08:38 AM
                                                                                                                                                  
                                                                                                                                                  

"BAD-TRAFFIC loopback traffic" I am getting a lot of this one alert on
127.0.0.1. im really not sure what is causing this. If it is faulty
networking or maybe a spoofer. Now that I know im getting this, thanks to
SNORT, what the heck do I do about it? Anyone ever remedy this problem?

Chuck Holley
LAN Administrator
FitnessQuest Inc.
Canton, OH
cholleyfitnessquest.com

-------------------------------------------------------
This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek
For a limited time only, get FREE Ground shipping on all orders of $35
or more. Hurry up and shop folks, this offer expires April 30th!
http://www.thinkgeek.com/freeshipping/?cpg297
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users