Snort mailing list archives
Re: Re: Noob
From: J-H Johansen <ondemannen () gmail com>
Date: Thu, 23 Dec 2004 23:51:20 +0100
<snip> 21 - attempted-admin - NETBIOS SMB DCERPC NTLMSSP asn1 overflow attempt This comes from everywhere yet again is always destined for port 139 of some significant machine? <snip> I seem to recall that I got several of these because I'd failed to define the source net in HOME_NET and this looked like it was legitimate Active Directory (AD) controller traffic (the AD controller being the destination I think). Anyone else with similiar experience ? -- J-H Johansen -- There are 10 kinds of people in the world: Those who understand binary and those who don't... ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Noob Brian Stamper (Dec 22)
- Re: Noob Tim Slighter (Dec 22)
- <Possible follow-ups>
- Re: Noob Brian Stamper (Dec 23)
- RE: Re: Noob Bob Konigsberg (Dec 23)
- Re: Re: Noob Brian Caswell (Dec 24)
- RE: Re: Noob Brian Stamper (Dec 23)
- RE: Re: Noob Bob Konigsberg (Dec 23)
- Re: Re: Noob J-H Johansen (Dec 23)
- RE: Re: Noob Bob Konigsberg (Dec 23)
- RE: Re: Noob Brian Stamper (Dec 23)
- RE: Re: Noob Frank Knobbe (Dec 23)
- RE: Re: Noob Brian Stamper (Dec 23)