Snort mailing list archives
wrong payload entered into data table with 2.2.0 and mysql
From: "Brancato, Mike" <mike.brancato () acs-inc com>
Date: Mon, 30 Aug 2004 12:10:29 -0400
The other day I got a 'FTP EXPLOIT STAT *' event in my IDS from one of our machines to a customer's FTP machine. We FTP to that machine on port 21 all day long, so I know that it is just a false positive. I looked at the decoded payload, and the traffic is HTTP traffic from our recruiting website which is totally different from the machine snort reported this as. It has an HTTP GET request, passes the User-Agent and HTTP Referrer data as well, so I know this is true HTTP traffic. So the destination machine is a known FTP server we use daily on port 21, but the data in the packet according to snort is HTTP traffic from our recruiting website. What is going on here? If anyone wants me to send more data about this for debugging, just email me direct. Regards, -- Michael Brancato Senior Network Engineer Affiliated Computer Services, Inc. Lexington Division, Business Process Solutions 2432 Fortune Drive, Suite 120 Lexington, KY 40509 p: 859.389.4012 c: 859.420.7773 "The first version of Linux was like a time machine. It went back to a system worse than what [Linus] already had on his desk." - Andy Tanenbaum, author of MINIX. ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- wrong payload entered into data table with 2.2.0 and mysql Brancato, Mike (Aug 31)
- Re: wrong payload entered into data table with 2.2.0 and mysql Bamm Visscher (Aug 31)