Re: Testing Snort with Blade IDS Informer

[Paul Schmehl <pauls () utdallas edu>]

--On Wednesday, April 27, 2005 07:47:53 PM +0200 Holger Mense 
<holger () project2501 de> wrote:
> However, I was a bit disappointed about the results. Besides the back
> orifice  and the two portscan attempts, my sensor didn't detect anything
> else of the  remaining 7 attacks provided by IDS Informer.
>
> In detail it didn't detect
>  - TCP DNS Zone Transfer

I get these routinely.  Something has to be wrong with your config.  I'm 
also running snort 2.3.2.

>  - Smurf DOS attempt
>  - finger search
>  - IIS Unicode Traps
>  - IIS htr Buffer Overflow
>  - rpc.statd exploit
>  - traceroute attempt
All of these have trigged from time to time on our network.  Something is 
wrong with the config you're using.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users