RE: snoop output contradicts with snort database

["Jeff Jennings" <jjennings () zoominternet net>]

There's always 'format c:' if the beer doesn't work..
 
:-)
 
 
-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Gongya Yu
Sent: Saturday, February 09, 2002 5:15 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] snoop output contradicts with snort database
 
Hi, all:
    I have a win2k box compromised. After I boot up that box, I use
snoop to find that it sends
lots of packets to remote machines on port 80 from random local ports. I
set up a snort box to plugin to oracle
database. When I query tcphdr table, I found tcp_sport contains port 80,
while tcp_dport contains random ports.
any suggestions.
Gongya Yu
 
=================================