Snort mailing list archives
Re: Snort-users digest, Vol 1 #2424 - 1 msg
From: "Mike Cole" <Mike.Cole () stanct org>
Date: Thu, 24 Oct 2002 13:35:32 -0700
I'm out of the office until Monday the 28th. If this is a pressing matter, please call me @ 209.569.3910 and I'll do my best to get back to you. Mike
snort-users 10/24/02 13:22 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2423 - 1 msg (Mike Cole)
--__--__--
Message: 1
Date: Thu, 24 Oct 2002 13:26:05 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2423 - 1 msg
I'm out of the office until Monday the 28th. If this is a pressing =
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
you.
Mike
snort-users 10/24/02 13:14 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2421 - 1 msg (Mike Cole)
-- __--__--
Message: 1
Date: Thu, 24 Oct 2002 13:17:52 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2421 - 1 msg
I'm out of the office until Monday the 28th. If this is a pressing =3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
you.
Mike
snort-users 10/24/02 13:06 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2419 - 1 msg (Mike Cole)
-- __--__-- =20
Message: 1
Date: Thu, 24 Oct 2002 13:09:54 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2419 - 1 msg
I'm out of the office until Monday the 28th. If this is a pressing =3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
you.
Mike
snort-users 10/24/02 12:54 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2417 - 1 msg (Mike Cole)
-- __--__-- =3D20
Message: 1
Date: Thu, 24 Oct 2002 12:57:13 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2417 - 1 msg
I'm out of the office until Monday the 28th. If this is a pressing =
=3D3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
=3D3D3D
you.
Mike
snort-users 10/24/02 12:41 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2415 - 1 msg (Mike Cole)
-- __--__-- =3D3D20
Message: 1
Date: Thu, 24 Oct 2002 12:45:00 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2415 - 1 msg
I'm out of the office until Monday the 28th. If this is a pressing =3D
=3D3D3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
you.
Mike
snort-users 10/24/02 12:33 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2414 - 2 msgs (Mike Cole)
-- __--__-- =3D3D3D20
Message: 1
Date: Thu, 24 Oct 2002 12:36:33 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2414 - 2 msgs
I'm out of the office until Monday the 28th. If this is a pressing =3D3D
=3D3D3D3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
you.
Mike
snort-users 10/24/02 12:25 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. RE: Is this a valid rule? (McCammon, Keith)
2. Re: Snort-users digest, Vol 1 #2413 - 1 msg (Mike Cole)
-- __--__-- =3D3D3D3D20
Message: 1
Subject: RE: [Snort-users] Is this a valid rule?
Date: Thu, 24 Oct 2002 15:17:08 -0400
From: "McCammon, Keith" <Keith.McCammon () eadvancemed com>
To: "Lefevre, Steven" <SLefevre () i-m-i-international com>,
"Snort-List" <snort-users () lists sourceforge net>
No semi-colon after the msg definition?
-----Original Message----- From: Lefevre, Steven [mailto:SLefevre () i-m-i-international com] Sent: Thursday, October 24, 2002 2:52 PM To: Snort-List Subject: [Snort-users] Is this a valid rule? =3D3D3D3D3D3D20 =3D3D3D3D3D3D20 I have this rule in my local rule file: =3D3D3D3D3D3D20 alert tcp $EXTERNAL_NET any -> $HOME_NET 6008:6009 (msg:"IRC=3D3D3D3D3D3D=
20=3D
Activity") =3D3D3D3D3D3D20 (It's to detect IRC traffic ;) =3D3D3D3D3D3D20 Why does snort always choke on it? I've looked it over 100=3D3D3D3D3D3D20=
times and it seems to follow the syntax. =3D3D3D3D3D3D20 =3D3D3D3D3D3D20 =3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D20 of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3Dsnort-users =3D3D3D3D3D3D20
-- __--__-- =3D3D3D3D20 Message: 2 Date: Thu, 24 Oct 2002 12:28:43 -0700 From: "Mike Cole" <Mike.Cole () stanct org> Reply-To: Mike.Cole () stanct org To: <snort-users () lists sourceforge net> Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2413 - 1 msg I'm out of the office until Monday the 28th. If this is a pressing = =3D3D3D =3D3D3D3D3D3D matter, please call me @ 209.569.3910 and I'll do my best to get back to = =3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D you. Mike
snort-users 10/24/02 12:16 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2412 - 1 msg (Mike Cole)
-- __--__-- =3D3D3D3D3D20
Message: 1
Date: Thu, 24 Oct 2002 12:20:02 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2412 - 1 msg
I'm out of the office until Monday the 28th. If this is a pressing =3D
=3D3D3D3D
=3D3D3D3D3D3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
you.
Mike
snort-users 10/24/02 12:09 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2411 - 4 msgs (Mike Cole)
-- __--__-- =3D3D3D3D3D3D20
Message: 1
Date: Thu, 24 Oct 2002 12:12:53 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2411 - 4 msgs
I'm out of the office until Monday the 28th. If this is a pressing =3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
you.
Mike
snort-users 10/24/02 12:02 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. RE: Portscan 2 question (Joe Giles)
2. Is this a valid rule? (Lefevre, Steven)
3. Re: dual inteface? (Phil Wood)
4. Re: Snort-users digest, Vol 1 #2410 - 3 msgs (Mike Cole)
-- __--__-- =3D3D3D3D3D3D3D20
Message: 1
Subject: RE: [Snort-users] Portscan 2 question
From: Joe Giles <jgiles () joeman1 com>
To: "Hicks, John" <JHicks () JUSTICE GC CA>
Cc: Snort-List <snort-users () lists sourceforge net>
Date: 24 Oct 2002 12:51:31 -0600
Well, I do use AIM. I also have a Game server running on port 27016 and
27017.=3D3D3D3D3D3D3D3D20
If this is normal TCP/UDP communication, I'm OK with that. I was just
concerned that someone hacked me and was using my machine as a proxy to
attack other machines(Or at least scan other machines). But I cant see
any evidence of that. I have checked the logs, bash_history of my few
users, and a neat tool called last. I also ran a root kit check. So, at
this point, I'm pretty sure that it is just normal traffic. Just threw
me off guard cause I have never seen this before in ACID...
Thanks
Joe
On Thu, 2002-10-24 at 12:38, Hicks, John wrote:
Instance #2 is what I was assuming your issue to be. Instance #1 imho =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D needs
more correlation, but given UDP and the destination port being the same, =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D i'd
assume maybe IM? =3D3D3D3D3D3D3D3D20 John =3D3D3D3D3D3D3D3D20 -----Original Message----- From: Joe Giles [mailto:jgiles () joeman1 com] Sent: Thursday, October 24, 2002 2:26 PM To: Soren Macbeth Cc: Snort-List Subject: RE: [Snort-users] Portscan 2 question =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 Here is what I found in that scan.log file for the 2 dest IP's...=3D3D3D3=
D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D2=3D3D3D3D3D 0
=3D3D3D3D3D3D3D3D20 Instance 1> 10/17-14:29:25.712618 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33905 dport: 27160 tgts: 10 ports: 114 event_id: 1525 10/18-12:05:07.946026 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1641 dport: 27160 tgts: 9 ports: 130 event_id: 400 10/18-13:22:24.504843 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 2804 dport: 27160 tgts: 8 ports: 121 event_id: 433 10/18-13:33:27.113376 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 3782 dport: 27160 tgts: 9 ports: 139 event_id: 450 10/18-13:36:00.675879 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 4825 dport: 27160 tgts: 10 ports: 158 event_id: 458 10/18-14:52:00.545930 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 34177 dport: 27160 tgts: 7 ports: 129 event_id: 1021 10/18-19:04:12.292185 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1628 dport: 27160 tgts: 10 ports: 130 event_id: 1161 10/19-12:38:43.719170 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 34139 dport: 27160 tgts: 9 ports: 126 event_id: 1417 10/19-19:16:04.828533 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1637 dport: 27160 tgts: 11 ports: 129 event_id: 1585 10/19-19:41:53.321697 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1649 dport: 27160 tgts: 10 ports: 125 event_id: 1600 10/19-21:13:32.829862 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33921 dport: 27160 tgts: 11 ports: 112 event_id: 1639 10/22-14:51:35.899289 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33952 dport: 27160 tgts: 3 ports: 21 event_id: 0 =3D3D3D3D3D3D3D3D20 Instance 2> 10/23-11:17:52.681476 TCP src: <INTERNALIP> dst: 206.65.183.110 sport: 1097 dport: 80 tgts: 6 ports: 7 flags: ******S* event_id: 0 =3D3D3D3D3D3D3D3D20 What do you think? =3D3D3D3D3D3D3D3D20 Thanks =3D3D3D3D3D3D3D3D20 Joe =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 On Thu, 2002-10-24 at 12:02, Soren Macbeth wrote:Looks at the ports that portscan2 reported. Sometime clients browsing websites cause portscan2 to trigger based on the fact that some =3D3D
=3D3D3D3D3D =3D3D3D3D3D3D3D3D browsers
initiate a new connection (and thus, new port) for each image. If you haven't change the config, there should be a scan.log file in your =
=3D3D =3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D snort
logdirectory which will have more info. =3D3D3D3D3D3D3D3D20 //soren=3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 -----Original Message----- From: Joe Giles [mailto:jgiles () joeman1 com]=3D3D3D3D3D3D3D3D20 Sent: Thursday, October 24, 2002 1:23 PM To: Snort-List Subject: [Snort-users] Portscan 2 question =3D3D3D3D3D3D3D3D20 I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D the
new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their =
=3D3D3D3D =3D3D3D3D3D3D3D3D network.
=3D3D3D3D3D3D3D3D20 Thanks =3D3D3D3D3D3D3D3D20 Joe =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3=
D2=3D 0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3Dsnort-us=
er=3D s
=3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3=
D2=3D 0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3Dsnort-us=
er=3D s
=3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D2=
0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3Dsnort-user=
s -- __--__-- =3D3D3D3D3D3D3D20 Message: 2 From: SLefevre () i-m-i-international com (Lefevre, Steven) To: "Snort-List" <snort-users () lists sourceforge net> Date: Thu, 24 Oct 2002 14:52:24 -0400 Subject: [Snort-users] Is this a valid rule? I have this rule in my local rule file: alert tcp $EXTERNAL_NET any -> $HOME_NET 6008:6009 (msg:"IRC Activity") (It's to detect IRC traffic ;) Why does snort always choke on it? I've looked it over 100 times and it seems to follow the syntax. -- __--__-- =3D3D3D3D3D3D3D20 Message: 3 From: Phil Wood <cpw () lanl gov> Date: Thu, 24 Oct 2002 13:00:30 -0600 To: Daniel Curry <dcurry () corio com> Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] dual inteface? If you have an os and pcap that supports the "any" interface, then you = =3D3D =3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D could: snort ... -i any ... This may not be what you want since you get all the interfaces on your = =3D3D =3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D box. I found that it did not appear to work with shared libraries (but that might be due to some funny stuff on my end). So, I built a static snort. (add -static to LDFLAGS and reload, might need -lz at tail end of load line). On Thu, Oct 24, 2002 at 08:28:04AM -0700, Daniel Curry wrote:
I had lost the email that gave information on how to configure snort to see two, eth2 and eth3, promicus interfaces on a redhat 7.2 system? I did not see the information in http://sourceforge.net/mailarchive. Thank you. =3D3D3D3D3D3D3D3D20 --=3D3D3D3D3D3D3D3D20 Daniel Curry DIRECT 650-232-4006 FAX 650-232-3200 PGP AD5A 96DC 7556 A020 B8E7 0E4D 5D5E 9BA5 C83E 8C92 =3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D2=
0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D20 http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavo=
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D te
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3Dsnort-user=
s --=3D3D3D3D3D3D3D3D20 Phil Wood, cpw () lanl gov -- __--__-- =3D3D3D3D3D3D3D20 Message: 4 Date: Thu, 24 Oct 2002 12:05:10 -0700 From: "Mike Cole" <Mike.Cole () stanct org> Reply-To: Mike.Cole () stanct org To: <snort-users () lists sourceforge net> Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2410 - 3 msgs I'm out of the office until Monday the 28th. If this is a pressing = =3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D matter, please call me @ 209.569.3910 and I'll do my best to get back to = =3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D you. Mike
snort-users 10/24/02 11:51 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. RE: Portscan 2 question (Hicks, John)
2. Snort 1.9.0 on Windows and MSSQL (Robbins, Mark)
3. Re: Snort-users digest, Vol 1 #2409 - 1 msg (Mike Cole)
-- __--__-- =3D3D3D3D3D3D3D3D20
Message: 1
From: "Hicks, John" <JHicks () JUSTICE GC CA>
To: 'Joe Giles' <jgiles () joeman1 com>
Cc: "Snort Users (E-mail)" <snort-users () lists sourceforge net>
Subject: RE: [Snort-users] Portscan 2 question
Date: Thu, 24 Oct 2002 14:33:24 -0400
it's 'last' and again, *any* service allowing ephemeral ports may cause =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
this
not just DNS.
cheers,
John
-----Original Message-----
From: Joe Giles [mailto:jgiles () joeman1 com]
Sent: Thursday, October 24, 2002 2:13 PM
To: Robby Desmond
Cc: Snort-List
Subject: Re: [Snort-users] Portscan 2 question
Well, I'm not RUNNING a DNS server, but I use one. My ISP's DNS...
Should I add that to the list?=3D3D3D3D3D3D3D3D3D20
Also, I don't seem to have the 'lasts' command. What package is that
part of?
Thanks for the reply
Joe
On Thu, 2002-10-24 at 12:03, Robby Desmond wrote:
At 11:22 AM 10/24/02 -0600, you wrote:I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. Thanks Joe=3D3D3D3D3D3D3D3D3D20 Are you, by chance, running DNS? =3D3D3D3D3D3D3D3D3D20 You should add your DNS servers to the list of portscan2-ignorehosts,=3D3=
D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D3=3D3D3D3D3D D3=3D3D3D3D3D3D D3=3D3D3D3D3D3D3D D2=3D3D3D3D3D3D3D3D 0
otherwise you will get this sort of activity. =3D3D3D3D3D3D3D3D3D20 If you are not running DNS, then check the "lasts" command to see who =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D has=3D3D3D3D3D3D3D3D3D20
been on your system. (Or who has been appearing as someone on your
system.)
=3D3D3D3D3D3D3D3D3D20 -Robby =3D3D3D3D3D3D3D3D3D20 Robert Desmond Systems Administrator UCSB Extended Learning Services 805-893-4906
------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3D2= 0 of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3Dsnort-user= s -- __--__-- =3D3D3D3D3D3D3D3D20 Message: 2 From: "Robbins, Mark" <MRobbins () sf edu> To: snort-users () lists sourceforge net Date: Thu, 24 Oct 2002 13:43:46 -0500 Subject: [Snort-users] Snort 1.9.0 on Windows and MSSQL This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=3D3D3D3D3D3D3D3D3D3D_NextPart_001_01C27B8D.48E86470 Content-Type: text/plain Has anyone gotten Snort 1.9.0 to log to an MSSQL database with the =3D =3D3D3D3D3D =3D3D3D3D3D3D3D3D3D available (compiled) executables? I am getting the error message=3D3D3D3D3D3D3D3D3D20 database: SQL Server message 156, state 1, severity 15: Incorrect syntax near the keyword 'schema'. database: The above error was caused by the following statement: SELECT vseq FROM schema In MSSQL, schema is a reserved word, and the syntax would have to be = =3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D SELECT vseq FROM [schema] for this to work. I have used previous versions of =3D =3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D snort to log to MSSQL with no difficulty. Could this problem arise from a configuration mistake I have made, or is = =3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D the problem in snort.exe itself? Thanks for any help you can provide. Mark Robbins ------_=3D3D3D3D3D3D3D3D3D3D_NextPart_001_01C27B8D.48E86470 Content-Type: text/html Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D3D3D3D3D3D3D3D3D3D3D"Content-Type" CONTENT=3D3D3D3D3D3D3= D3D3=3D D3D3=3D3D D"te=3D3D3D xt/h=3D3D3D3D tml;=3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D charset=3D3D3D3D3D3D3D3D3D3D3Dus-ascii"> <META NAME=3D3D3D3D3D3D3D3D3D3D3D"Generator" CONTENT=3D3D3D3D3D3D3D3D3D3D3D= "MS =3D =3D3D3D Exchange =3D3D3D3D Server =3D3D3D3D3D =3D3D3D3D3D3D version =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D 5.5.2653.12"> <TITLE>Snort 1.9.0 on Windows and MSSQL</TITLE> </HEAD> <BODY> <P><FONT SIZE=3D3D3D3D3D3D3D3D3D3D3D2 FACE=3D3D3D3D3D3D3D3D3D3D3D"Arial">Ha= s =3D =3D3D anyone =3D3D3D gotten =3D3D3D3D =3D3D3D3D3D Snort =3D3D3D3D3D3D 1.9.0 =3D3D3D3D3D3D3D to =3D3D3D3D3D3D3D3D log =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D to an MSSQL database with the available (compiled) executables?</FONT> </P> <P><FONT SIZE=3D3D3D3D3D3D3D3D3D3D3D2 FACE=3D3D3D3D3D3D3D3D3D3D3D"Arial">I = am =3D =3D3D getting =3D3D3D the =3D3D3D3D =3D3D3D3D3D error =3D3D3D3D3D3D =3D3D3D3D3D3D3D message =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D </FONT> </P> <P><FONT SIZE=3D3D3D3D3D3D3D3D3D3D3D2 FACE=3D3D3D3D3D3D3D3D3D3D3D"Arial">da= taba=3D se: =3D3D SQL =3D3D3D =3D3D3D3D Server =3D3D3D3D3D =3D3D3D3D3D3D message =3D3D3D3D3D3D3D 156, =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D state 1, severity 15:<BR> Incorrect syntax near the keyword 'schema'.</FONT> <BR><FONT SIZE=3D3D3D3D3D3D3D3D3D3D3D2 FACE=3D3D3D3D3D3D3D3D3D3D3D"Arial">d= atab=3D ase:=3D3D =3D3D3D The =3D3D3D3D above =3D3D3D3D3D =3D3D3D3D3D3D error =3D3D3D3D3D3D3D was =3D3D3D3D3D3D3D3D caused =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D by the following statement:<BR> SELECT vseq FROM schema</FONT> </P> <P><FONT SIZE=3D3D3D3D3D3D3D3D3D3D3D2 FACE=3D3D3D3D3D3D3D3D3D3D3D"Arial">In= =3D MSSQL, =3D3D =3D3D3D schema =3D3D3D3D is a =3D3D3D3D3D =3D3D3D3D3D3D3D reserved =3D3D3D3D3D3D3D3D word, =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D and the syntax would have to be SELECT vseq FROM [schema] for this to = =3D3D =3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D work. I have used previous versions of snort to log to MSSQL with no =3D =3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D difficulty.</FONT></P> <P><FONT SIZE=3D3D3D3D3D3D3D3D3D3D3D2 FACE=3D3D3D3D3D3D3D3D3D3D3D"Arial">Co= uld =3D =3D3D this =3D3D3D =3D3D3D3D problem =3D3D3D3D3D arise =3D3D3D3D3D3D from =3D3D3D3D3D3D3D a =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D configuration mistake I have made, or is the problem in snort.exe =3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D itself?</FONT> </P> <P><FONT SIZE=3D3D3D3D3D3D3D3D3D3D3D2 FACE=3D3D3D3D3D3D3D3D3D3D3D"Arial">Th= anks=3D =3D3D for =3D3D3D any =3D3D3D3D help =3D3D3D3D3D you =3D3D3D3D3D3D can =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D provide.</FONT> </P> <P><FONT SIZE=3D3D3D3D3D3D3D3D3D3D3D2 FACE=3D3D3D3D3D3D3D3D3D3D3D"Arial">Ma= rk =3D =3D3D3D Robbins</FONT=3D3D3D3D
</P> </BODY> </HTML> ------_=3D3D3D3D3D3D3D3D3D3D_NextPart_001_01C27B8D.48E86470-- -- __--__-- =3D3D3D3D3D3D3D3D20 Message: 3 Date: Thu, 24 Oct 2002 11:54:27 -0700 From: "Mike Cole" <Mike.Cole () stanct org> Reply-To: Mike.Cole () stanct org To: <snort-users () lists sourceforge net> Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2409 - 1 msg I'm out of the office until Monday the 28th. If this is a pressing =3D =3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D matter, please call me @ 209.569.3910 and I'll do my best to get back to = =3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D you. Mike
snort-users 10/24/02 11:43 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2408 - 3 msgs (Mike Cole)
-- __--__-- =3D3D3D3D3D3D3D3D3D20
Message: 1
Date: Thu, 24 Oct 2002 11:46:29 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2408 - 3 msgs
I'm out of the office until Monday the 28th. If this is a pressing =3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
you.
Mike
snort-users 10/24/02 11:36 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. Re: Snort-users digest, Vol 1 #2407 - 12 msgs (Mike Cole)
2. RE: Portscan 2 question (Soren Macbeth)
3. Re: Portscan 2 question (Gary Verhulp)
-- __--__-- =3D3D3D3D3D3D3D3D3D3D20
Message: 1
Date: Thu, 24 Oct 2002 11:36:47 -0700
From: "Mike Cole" <Mike.Cole () stanct org>
Reply-To: Mike.Cole () stanct org
To: <snort-users () lists sourceforge net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2407 - 12 msgs
I'm out of the office until Monday the 28th. If this is a pressing =
=3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
you.
Mike
snort-users 10/24/02 11:26 >>>
Send Snort-users mailing list submissions to
snort-users () lists sourceforge net
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
snort-users-request () lists sourceforge net
You can reach the person managing the list at
snort-users-admin () lists sourceforge net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."
Today's Topics:
1. RE: UDP packet supposedly DROPped, but seen by snor
t anyway (Matt Yackley)
2. RE: UDP packet supposedly DROPped, but seen by snort anyway (Jan =
=3D3D
=3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
Ploski)
3. RE: PROBLEMAS (Kreimendahl, Chad J)
4. Portscan 2 question (Joe Giles)
5. Re: dual inteface? (Bennett Todd)
6. RE: Portscan 2 question (Joe Giles)
7. RE: Portscan 2 question (Soren Macbeth)
8. Re: Portscan 2 question (Joe Giles)
9. Re: Portscan 2 question (Joe Giles)
10. Re: Portscan 2 question (Joe Giles)
11. RE: Portscan 2 question (Joe Giles)
-- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20
Message: 1
From: Matt Yackley <Matt.Yackley () perkinswill com>
To: 'Jan Ploski' <jpljpl () gmx de>, snort-users () lists sourceforge net
Subject: RE: [Snort-users] UDP packet supposedly DROPped, but seen by snor
t anyway
Date: Thu, 24 Oct 2002 11:23:35 -0500
Jan, it sounds like you are running Snort on the iptables box, AFAIK =
=3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
libpcap
grabs the packet when it hits the NIC, iptables is rejecting the packet =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
but
that happens at a higher level than libpcap & snort work at. =3D3D3D3D3D3D3=
D3=3D
D3=3D3D
D3=3D3D3D
D3=3D3D3D3D
D3=3D3D3D3D3D
D2=3D3D3D3D3D3D
0
Others here will expand more but my guess as to why the TCP is not picked =
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
up
by snort is due to the way the rules are written and the way TCP connection=
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
s
are handled. Most rules for TCP type connections will require a 3way
handshake to be completed before something like a cmd.exe attempt is sent.
If this type of connection is blocked at the start it never gets to the
point of sending a packet that triggers the rule. This UDP rule will
trigger with the first packet sent since it does not need a 3 way =
=3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
handshake
to be completed.
Anyway, that is my quick stab at this, everyone else please feel free to
correct me where I am wrong :)
Matt
-----Original Message-----
From: Jan Ploski [mailto:jpljpl () gmx de]
Sent: Thursday, October 24, 2002 10:23 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] UDP packet supposedly DROPped, but seen by snort
anyway
Hello,
I have the following rule in my Linux iptables configuration:
iptables -A block -m state --state NEW -p udp --dport 161 -j DROP
Basically, I want to ignore any traffic to UDP port 161. This rule
seems to work okay, i.e. it fires when a packet is sent to the said
port and the packet is never received by the process listening on
that port.
However, when I run snort in sniffer mode, I can see the packet
coming. It also triggers an alert (false positive in this case)
according to configured snort rules.
My question is, why can this UDP packet, supposedly already dropped
by the firewall, be sniffed at? This is not the case for any TCP
packets that have been DROPped.
Best regards -
Jan Ploski
-------------------------------------------------------
This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3D3=
D3=3D
D3=3D3D
D2=3D3D3D
0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D3D20
Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D3D20
http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavote=
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3D3Dsnor=
t-=3D
us=3D3D
er=3D3D3D
s
-- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20
Message: 2
Date: Thu, 24 Oct 2002 18:41:34 +0200 (CEST)
From: Jan Ploski <jpljpl () gmx de>
To: snort-users () lists sourceforge net
Subject: RE: [Snort-users] UDP packet supposedly DROPped, but seen by =
=3D3D
=3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
snort anyway
On Thu, Oct 24, 2002 at 11:23:35AM -0500, Matt Yackley wrote:
Jan, it sounds like you are running Snort on the iptables box, AFAIK =
=3D3D =3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D libpcap
grabs the packet when it hits the NIC, iptables is rejecting the packet =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D but
that happens at a higher level than libpcap & snort work at. =3D3D3D3D3D3=
D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D3=3D3D3D3D3D D3=3D3D3D3D3D3D D2=3D3D3D3D3D3D3D 0
Others here will expand more but my guess as to why the TCP is not =
=3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D picked up
by snort is due to the way the rules are written and the way TCP =
=3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D connections
are handled. Most rules for TCP type connections will require a 3way handshake to be completed before something like a cmd.exe attempt is =
=3D3D =3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D sent.
If this type of connection is blocked at the start it never gets to the point of sending a packet that triggers the rule. This UDP rule will trigger with the first packet sent since it does not need a 3 way =
=3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D handshake
to be completed. =3D3D3D3D3D3D3D3D3D3D3D3D20 Anyway, that is my quick stab at this, everyone else please feel free to correct me where I am wrong :)
Matt, you are entirely correct, and I have also received similiar suggestions from other people on this list via private email (thanks again!). The TCP SYN packet used to establish a connection indeed makes it through to snort, much like the UDP packet. Too bad I did not check this before posting... :-( As someone else suggested: "write a pass rule for it or you can use a bpf filter (not udp port 161) to ignore the traffic". This is indeed a good solution, as I know that port 161 is closed on the monitored box. Best regards - Jan Ploski -- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 Message: 3 Subject: RE: [Snort-users] PROBLEMAS Date: Thu, 24 Oct 2002 11:46:53 -0500 From: "Kreimendahl, Chad J" <Chad.Kreimendahl () umb com> To: "Mario Alberto Soto Cordones" <mario_soto () compuall cl>, <snort-users () lists sourceforge net> You may have to translate this back to spanish, 'cause my answer is gonna be in english. 1. Do you have the database tables set up for postgresql? 2. When snort starts, do you see a connection made to the database? 3. If no: Have you configured in snort.conf "output database postgresql: ....."? -----Original Message----- From: Mario Alberto Soto Cordones [mailto:mario_soto () compuall cl]=3D3D3D3D3= D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D3=3D3D3D3D3D D3=3D3D3D3D3D3D D3=3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D D2=3D3D3D3D3D3D3D3D3D 0 Sent: Thursday, October 24, 2002 1:09 PM To: snort-users () lists sourceforge net Subject: [Snort-users] PROBLEMAS Tengo instalado snort en un RH 8.0, y quiero enviar los logs a una base de=3D3D3D3D3D3D3D3D3D3D3D3D3D20 datos postgresql para que interactue con acid. Mi problema es que no se llena la base de datos con los alert del snort. Ayudenme porfavor. ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3D3= D3=3D D3=3D3D D3=3D3D3D D2=3D3D3D3D 0 of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D3D3D2= 0 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D3D3D20 http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javav ote _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3D3D3Dsn= or=3D t-=3D3D us=3D3D3D er=3D3D3D3D s -- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 Message: 4 From: Joe Giles <jgiles () joeman1 com> To: Snort-List <snort-users () lists sourceforge net> Date: 24 Oct 2002 11:22:36 -0600 Subject: [Snort-users] Portscan 2 question I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. Thanks Joe -- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 Message: 5 Date: Thu, 24 Oct 2002 13:28:44 -0400 From: Bennett Todd <bet () rahul net> To: Daniel Curry <dcurry () corio com> Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] dual inteface? --4zI0WCX1RcnW9Hbu Content-Type: text/plain; charset=3D3D3D3D3D3D3D3D3D3D3D3D3Dus-ascii Content-Disposition: inline 2002-10-24-11:28:04 Daniel Curry:
I had lost the email that gave information on how to configure snort to see two, eth2 and eth3, promicus interfaces on a redhat 7.2 system?
I think you're perhaps talking about this?
---------------------------------------------------------------------------=
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
---
Version 1.2 --- that promisc is only needed on the bond0 interface
Version 1.1 --- need to explicitly "promisc" on the ifconfigs;
snort's putting the -i bond0 into promisc didn't propogate
back through to the underlying eth interfaces.
---------------------------------------------------------------------------=
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
---
In Red Hat 7.3, with the default 2.4.18-3 kernel, it's really easy
to bond multiple channels to snort them all. The technique is
documented in /usr/src/linux/Documentation/networking/bonding.txt.
In brief:
grep bond0 /etc/modules.conf || echo alias bond0 bonding >/etc/modu=
=3D
=3D3D
=3D3D3D
=3D3D3D3D
=3D3D3D3D3D
=3D3D3D3D3D3D
=3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D
les.conf
ifconfig bond0 promisc up
for if in eth1 eth2 ...;do
ifconfig $if up
ifenslave bond0 $if
done
snort ... -i bond0 ...
Works great. The ifenslave invocations whinge a bit about all the
things they can't do with the unnumbered interfaces, but it all
works.
I used 3 Compaq DL-320s for a test setup. Each of these comes with
two eepro100 interfaces; in one I've added a third such interface in
the PCI slot. On each box the eth0 is the mgmt interface (NB when
you add a PCI card eepro100 it becomes eth0 and the two builtin NICs
renumber to eth1 and eth2).
Besides running the eth0 interfaces to a hub, I tied the two eth1s
from the dual-interface traffic generators to the eth1 and eth2
builtins on the 3-interface box, with crossover cables, running
100BaseT. I used the above invocations to get snort cooking with
its default sigs, listening to bond0 with eth1 and eth2 enslaved to
it. Snort sat idle. I fired up a ping -f on one of the generators
and snort jumped up to 25% CPU; then launched ping -f on the
other generator and it jumped to 55%. Each generator was emitting
c. 20,000 packets/second, default ping packet size (64 bytes).
When I next tried tcpreplay[1], all was not as happy, until I
stumbled across the above-mentioned need to promisc the bond0
interface manually as you're ifconfigging it. Actually, what I first
did was ifconfig both the bond0 and the underlying eth# interfaces
promisc; that worked too, but was overkill. When I inquired about
this matter on the bonding-devel mailing list, they explained to me
that flags like promisc _Are_ propogated down to the underlying
interfaces, but only at ifenslave time, not later.
Once I got that, things got lots more better. Do remember when
benchmarking with tcpreplay to make sure to tcpdump -s 0, so you
aren't using captures with truncated packets.
-Bennett
[1] <URL:http://tcpreplay.sf.net/>
--4zI0WCX1RcnW9Hbu
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE9uC3MHZWg9mCTffwRAgl4AJwPNKA0sb29K5VdNH1tkjtNeN262gCdEHIT
goT0xSBgTN0XxdUVPXyXAyQ=3D3D3D3D3D3D3D3D3D3D3D3D3D
=3D3D3D3D3D3D3D3D3D3D3D3D3DSRdE
-----END PGP SIGNATURE-----
--4zI0WCX1RcnW9Hbu--
-- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20
Message: 6
Subject: RE: [Snort-users] Portscan 2 question
From: Joe Giles <jgiles () joeman1 com>
To: "Hicks, John" <JHicks () JUSTICE GC CA>
Cc: Snort-List <snort-users () lists sourceforge net>
Date: 24 Oct 2002 11:54:41 -0600
Wheew... I though I was hacked or something. I thought some one was
using my server as a proxy to scan other networks :-P
I'm not sure how to alleviate this problem, but maybe the Snort guru's
can figure it out :)
Thanks
Joe
On Thu, 2002-10-24 at 11:46, Hicks, John wrote:
I'm noticing the same thing after instaling 1.9 on a Web Server. It =
=3D3D =3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D seems to
detect my $HOME_NET address replying to multiple web requests on various ephemeral ports as a portscan. any thoughts on how to control this? I =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D tried
the ignorehosts to no avail :( =3D3D3D3D3D3D3D3D3D3D3D3D20 John =3D3D3D3D3D3D3D3D3D3D3D3D20 -----Original Message----- From: Joe Giles [mailto:jgiles () joeman1 com] Sent: Thursday, October 24, 2002 1:23 PM To: Snort-List Subject: [Snort-users] Portscan 2 question =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. =3D3D3D3D3D3D3D3D3D3D3D3D20 Thanks =3D3D3D3D3D3D3D3D3D3D3D3D20 Joe =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3=
D3=3D D3=3D3D D3=3D3D3D D2=3D3D3D3D 0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D3D2=
0
Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3D3Dsn=
or=3D t-=3D3D us=3D3D3D er=3D3D3D3D s -- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 Message: 7 From: Soren Macbeth <smacbeth () atc-nycorp com> To: Snort-List <snort-users () lists sourceforge net> Subject: RE: [Snort-users] Portscan 2 question Date: Thu, 24 Oct 2002 14:02:40 -0400 Looks at the ports that portscan2 reported. Sometime clients browsing websites cause portscan2 to trigger based on the fact that some browsers initiate a new connection (and thus, new port) for each image. If you haven't change the config, there should be a scan.log file in your snort = =3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D log directory which will have more info. //soren=3D3D3D3D3D3D3D3D3D3D3D3D20 -----Original Message----- From: Joe Giles [mailto:jgiles () joeman1 com]=3D3D3D3D3D3D3D3D3D3D3D3D20 Sent: Thursday, October 24, 2002 1:23 PM To: Snort-List Subject: [Snort-users] Portscan 2 question I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. Thanks Joe ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3D3= D3=3D D3=3D3D D2=3D3D3D 0 of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3D3Dsnor= t-=3D us=3D3D er=3D3D3D s -- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 Message: 8 Subject: Re: [Snort-users] Portscan 2 question From: Joe Giles <jgiles () joeman1 com> To: Robby Desmond <rdesmond () els ucsb edu> Cc: Snort-List <snort-users () lists sourceforge net> Date: 24 Oct 2002 12:12:44 -0600 Well, I'm not RUNNING a DNS server, but I use one. My ISP's DNS... Should I add that to the list?=3D3D3D3D3D3D3D3D3D3D3D3D20 Also, I don't seem to have the 'lasts' command. What package is that part of? Thanks for the reply Joe On Thu, 2002-10-24 at 12:03, Robby Desmond wrote:
At 11:22 AM 10/24/02 -0600, you wrote:I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. Thanks Joe=3D3D3D3D3D3D3D3D3D3D3D3D20 Are you, by chance, running DNS? =3D3D3D3D3D3D3D3D3D3D3D3D20 You should add your DNS servers to the list of portscan2-ignorehosts,=3D3=
D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D3=3D3D3D3D3D D3=3D3D3D3D3D3D D3=3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D3D3D D2=3D3D3D3D3D3D3D3D3D3D3D 0
otherwise you will get this sort of activity. =3D3D3D3D3D3D3D3D3D3D3D3D20 If you are not running DNS, then check the "lasts" command to see who =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D has=3D3D3D3D3D3D3D3D3D3D3D3D20
been on your system. (Or who has been appearing as someone on your =
=3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D system.)
=3D3D3D3D3D3D3D3D3D3D3D3D20 -Robby =3D3D3D3D3D3D3D3D3D3D3D3D20 Robert Desmond Systems Administrator UCSB Extended Learning Services 805-893-4906
-- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 Message: 9 Subject: Re: [Snort-users] Portscan 2 question From: Joe Giles <jgiles () joeman1 com> To: Robby Desmond <rdesmond () els ucsb edu> Cc: Snort-List <snort-users () lists sourceforge net> Date: 24 Oct 2002 12:15:54 -0600 I also checked the history files of the 5 users I do have and nothing in there indicates that nmap or nessus or any other scanner was ran. And there was no sudo or su command initiated.=3D3D3D3D3D3D3D3D3D3D3D3D20 Thanks Joe On Thu, 2002-10-24 at 12:03, Robby Desmond wrote:
At 11:22 AM 10/24/02 -0600, you wrote:I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. Thanks Joe=3D3D3D3D3D3D3D3D3D3D3D3D20 Are you, by chance, running DNS? =3D3D3D3D3D3D3D3D3D3D3D3D20 You should add your DNS servers to the list of portscan2-ignorehosts,=3D3=
D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D3=3D3D3D3D3D D3=3D3D3D3D3D3D D3=3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D3D3D D2=3D3D3D3D3D3D3D3D3D3D3D 0
otherwise you will get this sort of activity. =3D3D3D3D3D3D3D3D3D3D3D3D20 If you are not running DNS, then check the "lasts" command to see who =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D has=3D3D3D3D3D3D3D3D3D3D3D3D20
been on your system. (Or who has been appearing as someone on your =
=3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D system.)
=3D3D3D3D3D3D3D3D3D3D3D3D20 -Robby =3D3D3D3D3D3D3D3D3D3D3D3D20 Robert Desmond Systems Administrator UCSB Extended Learning Services 805-893-4906
-- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 Message: 10 Subject: Re: [Snort-users] Portscan 2 question From: Joe Giles <jgiles () joeman1 com> To: Robby Desmond <rdesmond () els ucsb edu> Cc: Snort-List <snort-users () lists sourceforge net> Date: 24 Oct 2002 12:21:58 -0600 Hay, that is a neat command :).=3D3D3D3D3D3D3D3D3D3D3D3D20 Well, according to last, no one logged on but me during the time of the "Issue".=3D3D3D3D3D3D3D3D3D3D3D3D20 Thanks. I will add my ISP's DNS to the list and see if that helps. This is the first time I have seen this message in ACID since I upgraded to the new snort. That was better than a week ago. Thanks Joe On Thu, 2002-10-24 at 12:16, Robby Desmond wrote:
At 12:12 PM 10/24/02 -0600, you wrote:Well, I'm not RUNNING a DNS server, but I use one. My ISP's DNS... Should I add that to the list?=3D3D3D3D3D3D3D3D3D3D3D3D20 Yes. That will reduce your portscan alerts, but doesn't solve the =
=3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D problem=3D3D3D3D3D3D3D3D3D3D3D3D20
of your host causing portscan alerts. =3D3D3D3D3D3D3D3D3D3D3D3D20Also, I don't seem to have the 'lasts' command. What package is that part of?=3D3D3D3D3D3D3D3D3D3D3D3D20 Oops. Make that singular "last". It is a standard UNIX tool. =3D3D3D3D3D3D3D3D3D3D3D3D20Thanks for the reply Joe=3D3D3D3D3D3D3D3D3D3D3D3D20 No prob. =3D3D3D3D3D3D3D3D3D3D3D3D20 You might also want to check to see if any of the services you run =
=3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D from=3D3D3D3D3D3D3D3D3D3D3D3D20
your server periodically scan hosts for some reason. =3D3D3D3D3D3D3D3D3D3D3D3D20 HTH, -Robby =3D3D3D3D3D3D3D3D3D3D3D3D20 Robert Desmond Systems Administrator UCSB Extended Learning Services 805-893-4906
-- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 Message: 11 Subject: RE: [Snort-users] Portscan 2 question From: Joe Giles <jgiles () joeman1 com> To: Soren Macbeth <smacbeth () atc-nycorp com> Cc: Snort-List <snort-users () lists sourceforge net> Date: 24 Oct 2002 12:26:18 -0600 Here is what I found in that scan.log file for the 2 dest IP's...=3D3D3D3D3= D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D3=3D3D3D3D3D D3=3D3D3D3D3D3D D3=3D3D3D3D3D3D3D D2=3D3D3D3D3D3D3D3D 0 Instance 1> 10/17-14:29:25.712618 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33905 dport: 27160 tgts: 10 ports: 114 event_id: 1525 10/18-12:05:07.946026 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1641 dport: 27160 tgts: 9 ports: 130 event_id: 400 10/18-13:22:24.504843 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 2804 dport: 27160 tgts: 8 ports: 121 event_id: 433 10/18-13:33:27.113376 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 3782 dport: 27160 tgts: 9 ports: 139 event_id: 450 10/18-13:36:00.675879 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 4825 dport: 27160 tgts: 10 ports: 158 event_id: 458 10/18-14:52:00.545930 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 34177 dport: 27160 tgts: 7 ports: 129 event_id: 1021 10/18-19:04:12.292185 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1628 dport: 27160 tgts: 10 ports: 130 event_id: 1161 10/19-12:38:43.719170 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 34139 dport: 27160 tgts: 9 ports: 126 event_id: 1417 10/19-19:16:04.828533 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1637 dport: 27160 tgts: 11 ports: 129 event_id: 1585 10/19-19:41:53.321697 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1649 dport: 27160 tgts: 10 ports: 125 event_id: 1600 10/19-21:13:32.829862 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33921 dport: 27160 tgts: 11 ports: 112 event_id: 1639 10/22-14:51:35.899289 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33952 dport: 27160 tgts: 3 ports: 21 event_id: 0 Instance 2> 10/23-11:17:52.681476 TCP src: <INTERNALIP> dst: 206.65.183.110 sport: 1097 dport: 80 tgts: 6 ports: 7 flags: ******S* event_id: 0 What do you think? Thanks Joe On Thu, 2002-10-24 at 12:02, Soren Macbeth wrote:
Looks at the ports that portscan2 reported. Sometime clients browsing websites cause portscan2 to trigger based on the fact that some browsers initiate a new connection (and thus, new port) for each image. If you haven't change the config, there should be a scan.log file in your snort =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D3D log
directory which will have more info. =3D3D3D3D3D3D3D3D3D3D3D3D20 //soren=3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 -----Original Message----- From: Joe Giles [mailto:jgiles () joeman1 com]=3D3D3D3D3D3D3D3D3D3D3D3D20 Sent: Thursday, October 24, 2002 1:23 PM To: Snort-List Subject: [Snort-users] Portscan 2 question =3D3D3D3D3D3D3D3D3D3D3D3D20 I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. =3D3D3D3D3D3D3D3D3D3D3D3D20 Thanks =3D3D3D3D3D3D3D3D3D3D3D3D20 Joe =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3=
D3=3D D3=3D3D D3=3D3D3D D2=3D3D3D3D 0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D3D2=
0
Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3D3Dsn=
or=3D t-=3D3D us=3D3D3D er=3D3D3D3D s
=3D3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3=
D3=3D D3=3D3D D3=3D3D3D D2=3D3D3D3D 0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D3D2=
0
Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3D3Dsn=
or=3D t-=3D3D us=3D3D3D er=3D3D3D3D s -- __--__-- =3D3D3D3D3D3D3D3D3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D3D3D3D3D3D3D3D3D20 Message: 2 From: Soren Macbeth <smacbeth () atc-nycorp com> To: 'Joe Giles' <jgiles () joeman1 com>, Soren Macbeth <smacbeth () atc-nycorp com> Cc: Snort-List <snort-users () lists sourceforge net> Subject: RE: [Snort-users] Portscan 2 question Date: Thu, 24 Oct 2002 14:32:59 -0400 I'm not sure about the udp dport 27160 stuff. Are you running some application on that port? Its all traffic to on particular host. You may want to check into that. The second one is definitely benign web browsing. //soren -----Original Message----- From: Joe Giles [mailto:jgiles () joeman1 com]=3D3D3D3D3D3D3D3D3D3D3D20 Sent: Thursday, October 24, 2002 2:26 PM To: Soren Macbeth Cc: Snort-List Subject: RE: [Snort-users] Portscan 2 question Here is what I found in that scan.log file for the 2 dest IP's...=3D3D3D3D3= D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D3=3D3D3D3D3D D3=3D3D3D3D3D3D D2=3D3D3D3D3D3D3D 0 Instance 1> 10/17-14:29:25.712618 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33905 dport: 27160 tgts: 10 ports: 114 event_id: 1525 10/18-12:05:07.946026 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1641 dport: 27160 tgts: 9 ports: 130 event_id: 400 10/18-13:22:24.504843 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 2804 dport: 27160 tgts: 8 ports: 121 event_id: 433 10/18-13:33:27.113376 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 3782 dport: 27160 tgts: 9 ports: 139 event_id: 450 10/18-13:36:00.675879 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 4825 dport: 27160 tgts: 10 ports: 158 event_id: 458 10/18-14:52:00.545930 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 34177 dport: 27160 tgts: 7 ports: 129 event_id: 1021 10/18-19:04:12.292185 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1628 dport: 27160 tgts: 10 ports: 130 event_id: 1161 10/19-12:38:43.719170 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 34139 dport: 27160 tgts: 9 ports: 126 event_id: 1417 10/19-19:16:04.828533 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1637 dport: 27160 tgts: 11 ports: 129 event_id: 1585 10/19-19:41:53.321697 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 1649 dport: 27160 tgts: 10 ports: 125 event_id: 1600 10/19-21:13:32.829862 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33921 dport: 27160 tgts: 11 ports: 112 event_id: 1639 10/22-14:51:35.899289 UDP src: <INTERNALIP> dst: 207.19.97.119 sport: 33952 dport: 27160 tgts: 3 ports: 21 event_id: 0 Instance 2> 10/23-11:17:52.681476 TCP src: <INTERNALIP> dst: 206.65.183.110 sport: 1097 dport: 80 tgts: 6 ports: 7 flags: ******S* event_id: 0 What do you think? Thanks Joe On Thu, 2002-10-24 at 12:02, Soren Macbeth wrote:
Looks at the ports that portscan2 reported. Sometime clients browsing websites cause portscan2 to trigger based on the fact that some browsers initiate a new connection (and thus, new port) for each image. If you haven't change the config, there should be a scan.log file in your snort
log
directory which will have more info. =3D3D3D3D3D3D3D3D3D3D3D20 //soren=3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 -----Original Message----- From: Joe Giles [mailto:jgiles () joeman1 com]=3D3D3D3D3D3D3D3D3D3D3D20 Sent: Thursday, October 24, 2002 1:23 PM To: Snort-List Subject: [Snort-users] Portscan 2 question =3D3D3D3D3D3D3D3D3D3D3D20 I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. =3D3D3D3D3D3D3D3D3D3D3D20 Thanks =3D3D3D3D3D3D3D3D3D3D3D20 Joe =3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3=
D3=3D D3=3D3D D2=3D3D3D 0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3Dsnor=
t-=3D us=3D3D er=3D3D3D s
=3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3=
D3=3D D3=3D3D D2=3D3D3D 0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3Dsnor=
t-=3D us=3D3D er=3D3D3D s -- __--__-- =3D3D3D3D3D3D3D3D3D3D20 Message: 3 Date: Thu, 24 Oct 2002 11:58:01 -0700 From: Gary Verhulp <garyv () cips nokia com> Reply-To: gary.verhulp () nokia com To: Joe Giles <jgiles () joeman1 com>, snort-users () lists sourceforge net Subject: Re: [Snort-users] Portscan 2 question on most unix that I'm familiar with,it's "last" not "lasts" what OS are you on? what's the ports used in the scan? can you post a section of the alert? Gary Joe Giles wrote:
Well, I'm not RUNNING a DNS server, but I use one. My ISP's DNS... Should I add that to the list?=3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 Also, I don't seem to have the 'lasts' command. What package is that part of? =3D3D3D3D3D3D3D3D3D3D3D20 Thanks for the reply =3D3D3D3D3D3D3D3D3D3D3D20 Joe =3D3D3D3D3D3D3D3D3D3D3D20 On Thu, 2002-10-24 at 12:03, Robby Desmond wrote: =3D3D3D3D3D3D3D3D3D3D3D20At 11:22 AM 10/24/02 -0600, you wrote:I have a weird problem with 2 entries in my ACID database. Apparently, my server did a port scan on a remote machine. The problem is that no one here initiated a port scan. The database lists my server IP as the source and lists a dest IP. This is listed as a spp_portscan2. Does the new snort scan other machines on the Internet? I don't want any issues with other services because they think I'm port scanning their network. Thanks JoeAre you, by chance, running DNS? You should add your DNS servers to the list of portscan2-ignorehosts,=3D3=
D3=3D D3=3D3D D3=3D3D3D D3=3D3D3D3D D3=3D3D3D3D3D D3=3D3D3D3D3D3D D3=3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D D3=3D3D3D3D3D3D3D3D3D D2=3D3D3D3D3D3D3D3D3D3D 0
otherwise you will get this sort of activity. If you are not running DNS, then check the "lasts" command to see who =
=3D =3D3D =3D3D3D =3D3D3D3D =3D3D3D3D3D =3D3D3D3D3D3D =3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D has=3D3D3D3D3D3D3D3D3D3D3D20
been on your system. (Or who has been appearing as someone on your =3D3D
=3D3D3D3D3D =3D3D3D3D3D3D3D3D =3D3D3D3D3D3D3D3D3D3D3D system.)
-Robby Robert Desmond Systems Administrator UCSB Extended Learning Services 805-893-4906=3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20 ------------------------------------------------------- This sf.net email is sponsored by: Influence the future=3D3D3D3D3D3D3D3D3=
D3=3D D3=3D3D D2=3D3D3D 0
of Java(TM) technology. Join the Java Community=3D3D3D3D3D3D3D3D3D3D3D20 Process(SM) (JCP(SM)) program now.=3D3D3D3D3D3D3D3D3D3D3D20 http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3D3D3D3D3D3D3D3Dsnor=
t-=3D us=3D3D er=3D3D3D s
=3D3D3D3D3D3D3D3D3D3D3D20 =3D3D3D3D3D3D3D3D3D3D3D20
-- __--__-- =3D3D3D3D3D3D3D3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D3D3D3D3D3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D3D3D3D3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D3D3D3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D3D3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =3D20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- =20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest -- __--__-- _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest --__--__-- _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-users End of Snort-users Digest ------------------------------------------------------- This sf.net email is sponsored by: Influence the future of Java(TM) technology. Join the Java Community Process(SM) (JCP(SM)) program now. http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Snort-users digest, Vol 1 #2424 - 1 msg Mike Cole (Oct 24)