Question

"When analyzing the IDS logs, the system administrator notices connections from outside of the LAN have been sending packets where the Source IP address and Destination IP address are the same. There have been no alerts sent via email or logged in the IDS. Which type of an alert is this?

Answer 1

This is false negative. To be marked for alert.

Explanation:

The network administrator or network engineer when he or she is analyzing IDS logs and founded the ip address is same on source and destination both in outside side.

So the either TCPIP address has to change to be scanned across the network. Since same IP address is same pinging rate will high and pinging the same workstation or desktop or laptop.

Alert will not generate because both tcpip address same and if pinging is success.  Ids logs generates based true negative, true positive and false positive will not generate any alert.