Snort mailing list archives
RE: SA login failed.....
From: "Snort" <Snort () InterCept Net>
Date: Tue, 29 Mar 2005 10:07:26 -0500
Do you have port 1433 open to the internet? When you make a connection to a server, your source port is random, while the destination server replies on the same port. my initial thoughts are that you have port 1433 open to the internet or to that network where the source is coming from. Depending on your firewall, I myself would re-check my fw rules and run a packet sniffer to watch the traffic coming from and to that host. It better to see it in tcpdump or tethereal versus seeing alerts in snort, you see it real-time with all relevant info Thanks, Michael Brown, _____ From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Jeff Heckart Posted At: Tuesday, March 29, 2005 9:46 AM Posted To: Snort Conversation: SA login failed..... Subject: [Snort-users] SA login failed..... I am getting quite a few unusual alerts, and am confused with what I am seeing. The payload of the packet is: 04 01 00 3B 00 00 01 00 AA 27 00 18 48 00 00 01 ...;....*'..H... 0E 1B 00 4C 6F 67 69 6E 20 66 61 69 6C 65 64 20 ...Login failed 66 6F 72 20 75 73 65 72 20 27 73 61 27 2E 00 00 for user 'sa'... 00 00 FD 02 00 00 00 00 00 00 00 ..}........ The strange thing is that the source is: x.x.x.x:1433 (our network) Destination x.x.x.x: 2838/random (remote unknown network) This has now happened to two systems, both running mysql on tcp/1433. It just makes no sense that the source port is 1433. What am I missing here?
Current thread:
- SA login failed..... Jeff Heckart (Mar 29)
- RE: SA login failed..... Eric Hines (Mar 29)
- Re: SA login failed..... Joe Matusiewicz (Mar 29)
- <Possible follow-ups>
- RE: SA login failed..... SRH-Lists (Mar 29)
- RE: SA login failed..... Snort (Mar 29)
- RE: SA login failed..... Esler, Joel - Contractor (Mar 29)