Snort mailing list archives
RE: Anyone have problems with aanval?
From: Our World Is Here <info () lucretia ca>
Date: Fri, 27 Jan 2006 07:44:24 -0700
I too have (and still use) aanval, I do not notice this type of activity/anomaly. Yes this option is turned off. Plain and simple your config is whacked. If your 'using' safe mode against the wishes of the tool, you may be the culprit. Cheers, James Friesen, CIO Lucretia Enterprises "Our World Is Here..." Info at lucretia dot ca http://lucretia.ca
-----Original Message----- From: Michael Scheidell [mailto:scheidell () secnap net] Sent: Friday, January 27, 2006 4:34 AM To: Nerijus Krukauskas; Snort Users Subject: RE: [Snort-users] Anyone have problems with aanval?-----Original Message----- From: Nerijus Krukauskas [mailto:nkrukauskas () gmail com] Sent: Friday, January 27, 2006 3:01 AM To: Snort Users Cc: Michael Scheidell Subject: Re: [Snort-users] Anyone have problems with aanval? On 27/01/06, Michael Scheidell <scheidell () secnap net> wrote:We traced a very large data transfer from the host we had running aanval to 82.165.229.52 Interesting thing about that ip address: host www.aanval.com www.aanval.com is a nickname for aanval.com aanval.comhas address82.165.229.52 aanval.com mail is handled (pri=10) bymail.aanval.com82.165.229.51 is also known as oad.aanval.com. OAD stands for 'Offender Analysis Database'. And default install of aanval console sends lot's of data to that database. In aanval console goAanval ->System Options -> Processor Options -> uncheck the'Offender AnalysisDatabase' option -> press 'Update Options' -> see how thetraffic tooad.aanval.com stops.21GB? 7 hours? Do the math, that will saturate two t1's for 7 hours.
And you noticed this AFTER SEVEN HOURS? Wow. Pretty slack network monitoring.
And besides, we turned it off in system options the day we installed it. Did RTFM. Thanks for playing, next player?
------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Anyone have problems with aanval? Michael Scheidell (Jan 26)
- Re: Anyone have problems with aanval? Nerijus Krukauskas (Jan 27)
- <Possible follow-ups>
- RE: Anyone have problems with aanval? Michael Scheidell (Jan 27)
- Re: Anyone have problems with aanval? Nerijus Krukauskas (Jan 27)
- RE: Anyone have problems with aanval? Our World Is Here (Jan 27)
- RE: Anyone have problems with aanval? Michael Scheidell (Jan 27)