RE: TFTP root directory alert

["Jerry Shenk" <jshenk () decommunications com>]

Most servers can be run on any port.  You might want to look at the
decode of the packet and see if it's really what it states or if it's a
web page that included some key character combinations or something.

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Rowland,
Krisa W ERDC-ITL-MS Contractor
Sent: Tuesday, June 08, 2004 11:59 AM
To: 'snort-users () lists sourceforge net'
Subject: [Snort-users] TFTP root directory alert



I have gotten some alerts from an outside IP to an inside web-server
here for sig 520 TFTP root directory - but it's on port 80??  Is that
possible??  

Krisa Rowland 
ERDC Information Assurance Team 
(SAIC Contractor) 
3909 Halls Ferry Rd.,  Bldg. 8000 
Vicksburg, MS 39180 
601-634-2493 
krisa.w.rowland () erdc usace army mil