the meaning with arrows in alerts?

[Pontus Joakimsson <jpontus () ess nec de>]

found this in my log:

[**] [1:356:2] FTP passwd retreval attempt [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
08/06-14:10:46.916395 x.x.x.11:25733 -> x.x.x.8:21
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:149
***AP*** Seq: 0xDA6FB967  Ack: 0x63800E38  Win: 0x2798  TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS213]


Now, normally, you would say the attempt was from .11 address, the IP shown
before the '->' TO the IP after the '->'.

But I have a feeling, if you look at the port numbers, that its the way around, or?

Regards,
 Pontus Joakimsson


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users