New answers tagged snort
I understand this is an attempt to baseline your network, but in order to do so, you need to identify the applications and protocols that your business or agency depends upon. Catalog those; identify the servers, ports and acceptable client ranges. If you cannot identify what the mission depends upon and what is authorized to access those resources, then ...
Instead of having Snort listen on an interface, you can give it a packet capture to read. Snort will read and analyze the packets as if they came off the wire. See http://manual.snort.org/node8.html This would help you understand the packets that Snort detected.
Top 50 recent answers are included