Re: wrong payload entered into data table with 2.2.0 and mysql

[Bamm Visscher <bamm.visscher () gmail com>]

What version of snort are you running? There are known 'packet
mangling' problems with some (older) versions of snort.

Bammkkkk

On Mon, 30 Aug 2004 12:10:29 -0400, Brancato, Mike
<mike.brancato () acs-inc com> wrote:
> The other day I got a 'FTP EXPLOIT STAT *' event in my IDS from one of our
> machines to a customer's FTP machine.  We FTP to that machine on port 21 all
> day long, so I know that it is just a false positive.  I looked at the
> decoded payload, and the traffic is HTTP traffic from our recruiting website
> which is totally different from the machine snort reported this as.  It has
> an HTTP GET request, passes the User-Agent and HTTP Referrer data as well,
> so I know this is true HTTP traffic.
>
> So the destination machine is a known FTP server we use daily on port 21,
> but the data in the packet according to snort is HTTP traffic from our
> recruiting website.  What is going on here?
>
> If anyone wants me to send more data about this for debugging, just email me
> direct.
>
> Regards,
>
> --
> Michael Brancato
> Senior Network Engineer
> Affiliated Computer Services, Inc.
> Lexington Division, Business Process Solutions
> 2432 Fortune Drive, Suite 120
> Lexington, KY 40509
> p: 859.389.4012
> c: 859.420.7773
>
> "The first version of Linux was like a time machine. It went back to a
> system worse than what [Linus] already had on his desk."
>                                                 - Andy Tanenbaum, author of
> MINIX.
-- 
http://sguil.sf.net


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users