Snort mailing list archives

ATTACK RESPONSES 403 Forbidden

From: "Gould, Scott" <sgould () gogstats org>
Date: Mon, 22 Mar 2004 23:53:32 -0500

?
Hi, 
 
new to snort but loving it so far.  All going well, but a little stumped on something.
 
Seeing  
 
ATTACK RESPONSES 403 Forbidden
 
HTTP/1.1 403 Access Forbidden
Server: Microsoft-IIS/5.0
Date: Tue, 23 Mar 2004 04:24:14 GMT
Content-Length: 3779
Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html dir=ltr>
<head>
<style>
a:link...{font:8pt/11pt verdana; color:FF0000}
a:visited..{font
 
 
in a response from a Microsoft Exchange 2000 server to a Windows 2000 Server Domain Controller.  The Domain Controller 
is also a Global Catalog.  made sure no admins were accessing webmail from the Domain Controller, the machine did not 
even have a browser running when these responses cam back.  Wasn't aware of communication between a Domain controller 
and Exchange 200 server that takes place over http
 
Anyone with a windows shop see these and have any ideas?


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread:

ATTACK RESPONSES 403 Forbidden Gould, Scott (Mar 22)
- <Possible follow-ups>
- RE: ATTACK RESPONSES 403 Forbidden Gould, Scott (Mar 23)