On Wed, Dec 11, 2002 at 10:44:30PM -1000, Ben Beeson wrote: > I'm curious why the log shows two IP addresses that aren't > mine. Is that because snort is seeing the traffic pass my > external interface, or is something else up?
Your external interface is probably sharing the same collision or broadcast domain. If listen with tcpdump and filter out your IP, you will probably see more foreign packets. -Vince
