What is snort complaining about?

Question

linux

Good day everyone!
Delivered one of these days snort on the server. Because I practically have no experience with it left default configs. So the following entries began to appear in the alert-log:

[**] [1:527:8] BAD-TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
10/23-05:04:22.637386 0.0.0.0 -> 224.0. 0.1
IGMP TTL:1 TOS:0xC0 ID:0 IpLen:24 DgmLen:32 DF
IP Options (1) => RTRALT
[Xref => http://www.cert.org/advisories/CA-1997-28.html] [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=1999... => http://www.securityfocus.com/bid/2666
]

Is it worth responding to them?
PS
And in the snort configs there are a lot of settings for monitoring the ports of services that I don't have (for example, ORACLE). Is it possible to turn this thing off completely and will there be any sense in this in terms of saving resources?

Answer 1

He writes that suspicious traffic has been noticed, packets in which the source and destination match, and potentially such traffic could be a DoS attempt.
This does not mean that you have any problems.
It also provides links to information. It says the following:

II. Impact
Topic 1 - Teardrop
Any remote user can crash a vulnerable machine.
Topic 2 - Land
Any remote user that can send spoofed packets to a host can crash or "hang" that host.

That is, the following problems can potentially arise: a remote user can cause a failure and any remote user can "hang" the host to which such packets go.
There we see the following:

Red Hat Software
Topic 1 - Teardrop
Linux is not vulnerable.
Topic 2 - Land
Linux is not vulnerable.

If you have Linux, then there will most likely be no problems.

Answer 2

Address Value
224.0.0.1 All nodes in this segment

Similar to IGMP general query. habrahabr.ru/post/217585 - here is a good article on the topic of multicast.
I can’t say anything about Snort, because. I first heard about it after your post.