I have a NIDS which is alarming (Sig 4508) on dest port 8000. The NSDB states that this signature is designed to alert on UDP traffic destined to port 161. So why is this signature firing?
I am seeing this situation as well. I'm seeing destination ports all over the place. Are you using an IDSM? I'm seeing these alarms fire on my IDSM2s, but not on my appliances.
Can you capture some of the offending traffic and send it to mcerha@cisco.com? We'll need this to diagnose the problem. This signature definitely shouldn't fire for traffic on port 8000.
Learn, share, save
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
