Security Basics mailing list archives
RE: how do i read this IDS log?
From: "David Gillett" <gillettdavid () fhda edu>
Date: Mon, 29 Nov 2004 14:34:41 -0800
Different source ports may indicate that the attacker is running multiple processes/threads that are each conducting scans. Source port numbers rarely give you much more info than that, although a variety of source IP addresses with a slowly incrementing source port number may indicate that the sources were all spoofed by a single host.... David Gillett
-----Original Message----- From: Rino Mardo [mailto:joroxx () gmail com] Sent: Sunday, November 28, 2004 3:46 AM To: security-basics () securityfocus com Subject: how do i read this IDS log? folks, i have collected a small IDS log from my network. although i can somehow interpret that it seems to be an snmp vulnerability scan, i can't seem to figure out why the source ip is using different ports. appreciate your help on this. here is the complete scan: =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:19:32.187608 xx.xx.xx.xx:1630 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:1998 IpLen:20 DgmLen:265 Len: 237 30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06 ..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B ...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:19:32.891551 xx.xx.xx.xx:1630 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:2146 IpLen:20 DgmLen:267 Len: 239 30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C 0.......internal A1 81 DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 ............0..0 0B 06 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 ...+........0... 2B 06 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 +........0...+.. 02 01 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 ......0...+..... 02 01 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 .....0...+...... 01 01 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 ....0...+....... 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 ..........0...+. 01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 +............0.. 0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F .+............0. 06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 ..+............ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:19:33.357811 xx.xx.xx.xx:1630 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:2184 IpLen:20 DgmLen:265 Len: 237 30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06 ..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B ...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:20:01.592360 xx.xx.xx.xx:1914 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:2970 IpLen:20 DgmLen:265 Len: 237 30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06 ..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B ...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:20:03.127504 xx.xx.xx.xx:1914 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:3093 IpLen:20 DgmLen:267 Len: 239 30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C 0.......internal A1 81 DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 ............0..0 0B 06 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 ...+........0... 2B 06 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 +........0...+.. 02 01 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 ......0...+..... 02 01 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 .....0...+...... 01 01 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 ....0...+....... 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 ..........0...+. 01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 +............0.. 0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F .+............0. 06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 ..+............ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:20:03.191711 xx.xx.xx.xx:1914 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:3095 IpLen:20 DgmLen:265 Len: 237 30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06 ..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B ...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:21:38.373587 xx.xx.xx.xx:2587 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:4790 IpLen:20 DgmLen:265 Len: 237 30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06 ..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B ...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:21:39.142089 xx.xx.xx.xx:2587 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:4798 IpLen:20 DgmLen:267 Len: 239 30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C 0.......internal A1 81 DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 ............0..0 0B 06 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 ...+........0... 2B 06 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 +........0...+.. 02 01 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 ......0...+..... 02 01 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 .....0...+...... 01 01 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 ....0...+....... 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 ..........0...+. 01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 +............0.. 0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F .+............0. 06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 ..+............ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+=+=+=+ 11/22-10:21:39.873510 xx.xx.xx.xx:2587 -> 255.255.255.255:161 UDP TTL:128 TOS:0x0 ID:4800 IpLen:20 DgmLen:265 Len: 237 30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 ....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B ......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04 ........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06 ..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B ...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B ............0... 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............
Current thread:
- how do i read this IDS log? Rino Mardo (Nov 29)
- Re: how do i read this IDS log? Javier Sanchez (Nov 29)
- RE: how do i read this IDS log? David Gillett (Nov 29)
- <Possible follow-ups>
- RE: how do i read this IDS log? Beauford, Jason (Nov 29)
- Re: how do i read this IDS log? Don Parker (Nov 30)
- Re: how do i read this IDS log? Rino Mardo (Nov 30)
- Re: how do i read this IDS log? Ghaith Nasrawi (Nov 30)