Snort mailing list archives
Re: How should alerts be interpreted? hacker's_machine -> victim's_machine?
From: "Palula Brasil" <palula () uol com br>
Date: Thu, 13 Apr 2006 17:51:45 -0300
What would be these other variables? For example, I don't have a webserver, database, I have an internal ftp and that's all. At least for now. ----- Original Message ----- From: "Joel Esler" <joel.esler () sourcefire com> To: <patrick () internetsecurityguru com> Cc: "'Palula Brasil'" <palula () uol com br>; <snort-users () lists sourceforge net> Sent: Thursday, April 13, 2006 4:48 PM Subject: Re: [Snort-users] How should alerts be interpreted? hacker's_machine -> victim's_machine? I suggest that you define all your variables inside of the snort.conf. There are many to configure. -h is only one. J Patrick S. Harper wrote:
That is also assuming that you have all your variables set correctly. -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Palula
Brasil
Sent: Thursday, April 13, 2006 1:12 PM To: snort-users () lists sourceforge net Subject: [Snort-users] How should alerts be interpreted?
hacker's_machine ->
victim's_machine? Ok! Alerts are workin fine. But indeed there is another problem. Here is the problem: the alert file has these. [**] [122:7:0] (portscan) TCP Filtered Portsweep [**] 04/12-22:30:29.305031 x.x.x.x:port -> 38.119.49.39 PROTO255 TTL:0 TOS:0x0 ID:5901 IpLen:20 DgmLen:162 DF and... [**] [119:15:1] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY [**] 04/12-23:14:22.648030 x.x.x.x:port -> 66.165.172.181:80 TCP TTL:64 TOS:0x0 ID:30828 IpLen:20 DgmLen:1452 DF ***A**** Seq: 0x3B8C6DA9 Ack: 0x7AAF4300 Win: 0x5AC TcpLen: 32 TCP Options (3) => NOP NOP TS: 54649465 770359521 But the thing is that x.x.x.x:port is my machines IP and port. Looks like it's gone mad and is doing totally random port scans and http inspects on whatever machines. According to snort docs, the correct interpretation for these alerts is: hacker's machine -> victim's machines Has my machine gone mad and is making victims out of a sudden? Home
network
( -h x.x.x.x/x) has been defined, by the way. Thanks! :-) ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting
language
that extends applications into web and mobile media. Attend the live
webcast
and join the prime developer group breaking into this new coding
territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- How should alerts be interpreted? hacker's_machine -> victim's_machine? Palula Brasil (Apr 13)
- RE: How should alerts be interpreted? hacker's_machine -> victim's_machine? Patrick S. Harper (Apr 13)
- Re: How should alerts be interpreted? hacker's_machine -> victim's_machine? Joel Esler (Apr 13)
- Re: How should alerts be interpreted? hacker's_machine -> victim's_machine? Palula Brasil (Apr 13)
- Re: How should alerts be interpreted? hacker's_machine -> victim's_machine? Joel Esler (Apr 13)
- RE: How should alerts be interpreted? hacker's_machine -> victim's_machine? Patrick S. Harper (Apr 13)