Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
Is there a Snort rule that equates to “something suspicious flagged from a client side application?”
The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?