On Wed, 17 Apr 2002, John Hunter wrote: > I just installed snort and am logging some of my traffic. > > The snort logger is running on one host 192.168.1.4 and I am currently > logged into 192.168.1.3 running opera, emacs and a bunch of xterms. > > I notice there is a shitload of data about my web searches and web > pages I have visited that date back to last week that are being sent > to 192.168.1.4 (don't ask me why they are being sent there, I'm asking > you). > > Below are some examples (there are shitloads more, as I say dating back > to sites I visited last week). Is opera sending this? And if so, to > whom? And I wonder why it is going to 192.168.1.4 (that is the NFS > NIS server for the LAN, but not the firewall router. > > Paranoid in Chicago; please advise. I'm about to shut down opera and > rerun snort to see if opera is sending the data.
didn't look to closely, but is it possible that your cache, history, etc is stored on the nfs server? if so, you may be looking at nfs traffic on your network. /me goes and looks at the packet header info. _______________________________________________ Bits mailing list [EMAIL PROTECTED] http://www.sugoi.org/mailman/listinfo/bits
