Snort mailing list archives

PLEASE CC ME


From: "Stephan Weaver" <stephanweaver () hotmail com>
Date: Thu, 06 Nov 2003 20:41:55 +0000

Hello gooday list,
I am not on the list so can you guys please CC me at stephanweaver () hotmail com


Here goes....
I am having a problem

i run snort of the same machine as my proxy server
defined home net variable as 192.168.0.0/24.
clients using the proxy server are logged in snort as follows...

[**] [1:620:3] SCAN Proxy (8080) attempt [**]
[Classification: Attempted Information Leak] [Priority: 2]
11/06-16:40:07.970541 192.168.0.9:1117 -> 192.168.0.200:8080
TCP TTL:128 TOS:0x0 ID:41741 IpLen:20 DgmLen:48 DF
******S* Seq: 0x7C3CD1  Ack: 0x0  Win: 0x2000  TcpLen: 28
TCP Options (4) => MSS: 1460 NOP NOP SackOK

This is not supposed to be happening.

Thanks in Advance
Stephan Weaver

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: