Systems that are configured incorrectly can cause malfunctions and introduce vulnerabilities that are hard to detect and remedy. It is not always clear whether the misconfiguration is an honest mistake or if it is malicious. You can use information about incorrectly configured systems to help troubleshoot problems in your network and identify possible vulnerabilities.
Legitimate hosts are sometimes on IP addresses that are typically used for broadcast addresses or subnet masks, such as 255.255.255.0. These hosts can sometimes trigger events that identify exploits that use broadcast addresses, such as denial of service attacks or smurf attack.
These events are caused by hosts that freely share data with other hosts or authenticate without requiring a password, or requiring a weak or easily guessed password. Although it is not the best method, some administrators allow internal hosts to communicate this way. This activity can trigger events that detect host-to-host communication that is weak or out of compliance, such as the Smb_empty_password and Smb_guessable_password events.
Administrators sometimes neglect to disable IP routing, which is enabled by default on hosts that run the UNIX operating system. In most cases, these hosts are typically not configured properly and they can drop a significant number of packets.