Re: Re: Noob

[J-H Johansen <ondemannen () gmail com>]

<snip>

21 - attempted-admin - NETBIOS SMB DCERPC NTLMSSP asn1 overflow attempt This
comes from everywhere yet again is always destined for port 139 of some
significant machine?

<snip>

I seem to recall that I got several of these because I'd failed to
define the source net in HOME_NET and this looked like it was
legitimate Active Directory (AD) controller traffic (the AD controller
being the destination I think).

Anyone else with similiar experience ?

-- 
J-H Johansen
--
There are 10 kinds of people in the world: Those who understand binary and
those who don't...


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users